# MFA Support for Web App **URL:** \ **Category:** Web\ **Created:** [September 22, 2026, 4:31pm UTC](https://forum.xojo.com/t/mfa-support-for-web-app/88919 "2026-09-22T16:31:14Z")\ **Posts on this page:** 15\ **Page:** 1
**Author:** ![Keith\_Keller](https://forum.xojo.com/letter_avatar_proxy/v4/letter/k/b9bd4f/32.png) [@Keith\_Keller](https://forum.xojo.com/u/Keith_Keller)\ **Post date:** [September 22, 2026, 4:31pm UTC](https://forum.xojo.com/t/mfa-support-for-web-app/88919/1 "2026-09-22T16:31:14Z")
Is there a sample project in Xojo that I can reference to walk me through how to add MFA to my xojo web app? ---
**Author:** ![MarkusR](https://forum.xojo.com/user_avatar/forum.xojo.com/markusr/32/685_2.png) [@MarkusR](https://forum.xojo.com/u/MarkusR)\ **Post date:** [September 22, 2026, 7:39pm UTC](https://forum.xojo.com/t/mfa-support-for-web-app/88919/2 "2026-09-22T19:39:39Z")
> [@Keith\_Keller](#): > > MFA for extra 2FA usually you have a server like LinOTP or Keycloak/Single Sign-On (at companey) for Multi-Factor Authentication then use theirs api methods. this kind of software support often MS Authenticator, Google Authenticator, and some others. i guess paid online services exists too but i not used myself. implementation could be effortful. question is what Multi authentication ways you will use. something simple extra would be send a random code or link to mail address and then use this time-limited link for login to your page. something you have to consider is if the customer is at pc he maybe read the mail at phone. thats why often a code is used for read at phone and manual input at other device. ---
**Author:** ![Keith\_Keller](https://forum.xojo.com/letter_avatar_proxy/v4/letter/k/b9bd4f/32.png) [@Keith\_Keller](https://forum.xojo.com/u/Keith_Keller)\ **Post date:** [September 22, 2026, 7:52pm UTC](https://forum.xojo.com/t/mfa-support-for-web-app/88919/3 "2026-09-22T19:52:14Z")
I am considering two options for them to choose from: 1. sms to their phone 2. a code sent to their email address ---
**Author:** ![Christian\_Schmitz](https://forum.xojo.com/user_avatar/forum.xojo.com/christian_schmitz/32/158_2.png) [@Christian\_Schmitz](https://forum.xojo.com/u/Christian_Schmitz)\ **Post date:** [September 22, 2026, 8:00pm UTC](https://forum.xojo.com/t/mfa-support-for-web-app/88919/4 "2026-09-22T20:00:53Z")
I like it when a website asks me for my email. And then in the email is a one time link with some secret code. Like when I click login on the website, you generate such a random code and store it in the user record and send it in the email. Then when I click on the link, it has my random code as well as some other code like an UUID to find me in the database. The user clicks on the link and is logged in. PS: Don’t use the real record ID for user in the link.Something random and unique. ---
**Author:** ![Andrew\_Paul\_Dickey](https://forum.xojo.com/letter_avatar_proxy/v4/letter/a/82dd89/32.png) [@Andrew\_Paul\_Dickey](https://forum.xojo.com/u/Andrew_Paul_Dickey)\ **Post date:** [September 22, 2026, 8:54pm UTC](https://forum.xojo.com/t/mfa-support-for-web-app/88919/5 "2026-09-22T20:54:31Z")
@Keith_Keller, but also consider the use of passkeys which is now baked into Xojo web. See [New WebUserAuthentication Control: Look, Mom, No Passwords! – Xojo Programming Blog](https://blog.xojo.com/2025/12/09/new-webuserauthentication-control-look-mom-no-passwords/) . In respect of two-factor, we prefer OTC’s sent via email, as browsers will often try to populate the code directly from a users email, which makes for a better user experience. Kind regards, Andrew ---
**Author:** ![Anthony\_G\_Cyphers](https://forum.xojo.com/user_avatar/forum.xojo.com/anthony_g_cyphers/32/16862_2.png) [@Anthony\_G\_Cyphers](https://forum.xojo.com/u/Anthony_G_Cyphers)\ **Post date:** [September 22, 2026, 8:55pm UTC](https://forum.xojo.com/t/mfa-support-for-web-app/88919/6 "2026-09-22T20:55:34Z")
I have [GraffitiVerificationKit](https://graffitisuite.com/features/verificationkit/), which handles generation, sending, and validation. ---
**Author:** ![MarkusR](https://forum.xojo.com/user_avatar/forum.xojo.com/markusr/32/685_2.png) [@MarkusR](https://forum.xojo.com/u/MarkusR)\ **Post date:** [September 22, 2026, 10:48pm UTC](https://forum.xojo.com/t/mfa-support-for-web-app/88919/7 "2026-09-22T22:48:41Z")
> [@Keith\_Keller](#): > > 1. sms to their phone > > 2. a code sent to their email address With the SMS option, the user may have to provide their private mobile phone number. The email option may be delayed. If the website is only being used on a mobile device, switching to the email app and back can be cumbersome. If someone is using a website on a PC, they should not be forced to use a second device to access their emails. we should kept the right having no smart phone. ---
**Author:** ![MarkusR](https://forum.xojo.com/user_avatar/forum.xojo.com/markusr/32/685_2.png) [@MarkusR](https://forum.xojo.com/u/MarkusR)\ **Post date:** [September 22, 2026, 10:52pm UTC](https://forum.xojo.com/t/mfa-support-for-web-app/88919/8 "2026-09-22T22:52:28Z")
> [@Christian\_Schmitz](#): > > I like it when a website asks me for my email. And then in the email is a one time link with some secret code. you are in the IT business, let a housewife (with less pc experience) or older people do this procedure and watch 🙂 ---
**Author:** ![Keith\_Keller](https://forum.xojo.com/letter_avatar_proxy/v4/letter/k/b9bd4f/32.png) [@Keith\_Keller](https://forum.xojo.com/u/Keith_Keller)\ **Post date:** [September 22, 2026, 11:01pm UTC](https://forum.xojo.com/t/mfa-support-for-web-app/88919/9 "2026-09-22T23:01:37Z")
My plan is to offer each as an option for them to choose which they want to go with. ---
**Author:** ![Thom\_McGrath](https://forum.xojo.com/user_avatar/forum.xojo.com/thom_mcgrath/32/192_2.png) [@Thom\_McGrath](https://forum.xojo.com/u/Thom_McGrath)\ **Post date:** [September 23, 2026, 3:06pm UTC](https://forum.xojo.com/t/mfa-support-for-web-app/88919/10 "2026-09-23T15:06:50Z")
> [@Christian\_Schmitz](#): > > I like it when a website asks me for my email. And then in the email is a one time link with some secret code. I’m the opposite because it’s slow. In the time it takes for the email to arrive - even if it’s only a few seconds - my password manager could have completed the login multiple times. “Email to login”, “email as MFA”, and “text as MFA” are all “features” I ravenously try to turn off. Unfortunately, not all providers offer such a thing. @Keith_Keller Email/Text as MFA is fine for some people. I personally hate it. My preferred option is passkeys, second choice is [TOTP](https://en.wikipedia.org/wiki/Time-based_one-time_password). But my real point is people have different opinions, and new techniques still get introduced. Come up with a plan so that you can offer other options in the future. Maybe you start with email as MFA, then add TOTP later. Another thing to consider about using email as a second factor is that it’s very commonly also compromised. MFA was designed to combat password reuse only. If somebody has used the same password for their email and your system, email-based MFA provides no additional security since the attacker has access to both. And unless you’re storing passwords poorly, your system is not likely to be the breach point. The most common attack plan goes like this: 1. Attacker finds user credentials for SomeSite. 2. Attacker tries those credentials at the email provider. Some succeed. 3. Attacker finds Apple, Google, Microsoft, Sony, Meta, Steam, etc. emails and attempts password resets. 4. Attacker buys gift cards. You are “SomeSite” in this scenario, so your goal is to stop step 1. For example, not only am I hashing passwords, I hash my email addresses too. MFA is a good thing to offer - I offer it to too - I’m not trying to talk you out of it. But if somebody is trying to attack your user’s account via a password reset after compromising their email, that email-based MFA will not protect them. ---
**Author:** ![Christian\_Schmitz](https://forum.xojo.com/user_avatar/forum.xojo.com/christian_schmitz/32/158_2.png) [@Christian\_Schmitz](https://forum.xojo.com/u/Christian_Schmitz)\ **Post date:** [September 23, 2026, 3:31pm UTC](https://forum.xojo.com/t/mfa-support-for-web-app/88919/11 "2026-09-23T15:31:19Z")
Well, it would be great if someone implements Passkeys in JavaScript for Web apps. ---
**Author:** ![Thom\_McGrath](https://forum.xojo.com/user_avatar/forum.xojo.com/thom_mcgrath/32/192_2.png) [@Thom\_McGrath](https://forum.xojo.com/u/Thom_McGrath)\ **Post date:** [September 23, 2026, 3:36pm UTC](https://forum.xojo.com/t/mfa-support-for-web-app/88919/12 "2026-09-23T15:36:13Z")
Yeah I did passkeys very recently for normal JavaScript. They are quite a pain thanks to some odd bugs. For example, there is a feature that allows you to automatically create a passkey for the user and instruct their device to save it. Safari advertises that it works, but when you try to do so, the function just hangs and there’s not a thing you can do about it. I even tried to add a timeout and abort handler to cancel the request, but that wouldn’t do it either. So ultimately I had to leave that off or else some users wouldn’t be able to log in unless they already had a passkey. Getting them implemented for Xojo Web is probably a task best left for @Anthony_G_Cyphers to add to GraffitiKit. I’ve been out of the Xojo Web game for so long that I know very little about what the modern framework looks like. ---
**Author:** ![Keith\_Keller](https://forum.xojo.com/letter_avatar_proxy/v4/letter/k/b9bd4f/32.png) [@Keith\_Keller](https://forum.xojo.com/u/Keith_Keller)\ **Post date:** [September 23, 2026, 4:07pm UTC](https://forum.xojo.com/t/mfa-support-for-web-app/88919/13 "2026-09-23T16:07:21Z")
Great point! And to top it off, I have to test across multiple browsers that my users use. Firefox Chrome Edge Safari Brave Vivaldi I came to realize a few years ago that assuming those that inherited from Chromium only required me to test on Chromium or Chrome, but I quickly realized that there are times when results differ. ---
**Author:** ![Ricardo\_Cruz](https://forum.xojo.com/user_avatar/forum.xojo.com/ricardo_cruz/32/7852_2.png) [@Ricardo\_Cruz](https://forum.xojo.com/u/Ricardo_Cruz)\ **Post date:** [September 23, 2026, 7:30pm UTC](https://forum.xojo.com/t/mfa-support-for-web-app/88919/14 "2026-09-23T19:30:30Z")
Passkeys are already supported in Xojo Web through WebUserAuthentication since 2025r3: - [WebUserAuthentication — Xojo documentation](https://documentation.xojo.com/api/web/webuserauthentication.html#webuserauthentication) - [New WebUserAuthentication Control: Look, Mom, No Passwords! – Xojo Programming Blog](https://blog.xojo.com/2025/12/09/new-webuserauthentication-control-look-mom-no-passwords/) ---
**Author:** ![Thom\_McGrath](https://forum.xojo.com/user_avatar/forum.xojo.com/thom_mcgrath/32/192_2.png) [@Thom\_McGrath](https://forum.xojo.com/u/Thom_McGrath)\ **Post date:** [September 23, 2026, 7:31pm UTC](https://forum.xojo.com/t/mfa-support-for-web-app/88919/15 "2026-09-23T19:31:48Z")
Oh. Well there you go. Passkeys are ■■■■■■■ awesome.