Comprehensive comparison for Authentication technology in Software Development applications

const express = require('express');
const session = require('express-session');
const DuoWebSDK = require('@duosecurity/duo_web');
const crypto = require('crypto');

const app = express();

// Duo configuration from environment variables
const DUO_IKEY = process.env.DUO_IKEY;
const DUO_SKEY = process.env.DUO_SKEY;
const DUO_AKEY = crypto.randomBytes(32).toString('hex'); // Application secret key
const DUO_HOST = process.env.DUO_HOST;

// Session middleware configuration
app.use(session({
  secret: process.env.SESSION_SECRET || 'your-session-secret',
  resave: false,
  saveUninitialized: false,
  cookie: { secure: true, httpOnly: true, maxAge: 3600000 }
}));

app.use(express.json());
app.use(express.urlencoded({ extended: true }));

// Primary authentication endpoint
app.post('/api/login', async (req, res) => {
  const { username, password } = req.body;

  try {
    // Step 1: Validate primary credentials (database check)
    const user = await validatePrimaryCredentials(username, password);
    
    if (!user) {
      return res.status(401).json({ error: 'Invalid credentials' });
    }

    // Step 2: Generate Duo signature for 2FA
    const sigRequest = DuoWebSDK.signRequest(
      DUO_IKEY,
      DUO_SKEY,
      DUO_AKEY,
      username
    );

    // Store user info in session for verification after Duo callback
    req.session.pendingUser = {
      userId: user.id,
      username: user.username,
      timestamp: Date.now()
    };

    res.json({
      requiresMFA: true,
      sigRequest: sigRequest,
      duoHost: DUO_HOST
    });

  } catch (error) {
    console.error('Login error:', error);
    res.status(500).json({ error: 'Authentication service unavailable' });
  }
});

// Duo callback endpoint after 2FA completion
app.post('/api/duo-callback', async (req, res) => {
  const { sigResponse } = req.body;

  try {
    // Verify session exists and hasn't expired
    if (!req.session.pendingUser) {
      return res.status(401).json({ error: 'Session expired or invalid' });
    }

    const sessionAge = Date.now() - req.session.pendingUser.timestamp;
    if (sessionAge > 300000) { // 5 minute timeout
      delete req.session.pendingUser;
      return res.status(401).json({ error: 'Authentication timeout' });
    }

    // Verify Duo response signature
    const authenticatedUsername = DuoWebSDK.verifyResponse(
      DUO_IKEY,
      DUO_SKEY,
      DUO_AKEY,
      sigResponse
    );

    // Ensure username matches session
    if (authenticatedUsername !== req.session.pendingUser.username) {
      delete req.session.pendingUser;
      return res.status(401).json({ error: 'Authentication mismatch' });
    }

    // Create authenticated session
    const user = req.session.pendingUser;
    delete req.session.pendingUser;
    
    req.session.authenticatedUser = {
      userId: user.userId,
      username: user.username,
      authenticatedAt: Date.now(),
      mfaVerified: true
    };

    res.json({
      success: true,
      user: {
        id: user.userId,
        username: user.username
      },
      token: generateJWT(user) // Generate JWT for API access
    });

  } catch (error) {
    console.error('Duo verification error:', error);
    delete req.session.pendingUser;
    res.status(401).json({ error: 'MFA verification failed' });
  }
});

// Protected API endpoint example
app.get('/api/protected-resource', requireAuth, (req, res) => {
  res.json({
    message: 'Access granted',
    user: req.session.authenticatedUser.username
  });
});

// Authentication middleware
function requireAuth(req, res, next) {
  if (!req.session.authenticatedUser || !req.session.authenticatedUser.mfaVerified) {
    return res.status(403).json({ error: 'Authentication required' });
  }
  next();
}

// Simulated database validation (replace with actual DB logic)
async function validatePrimaryCredentials(username, password) {
  // In production: query database, verify bcrypt hash, etc.
  if (username && password) {
    return { id: 12345, username: username };
  }
  return null;
}

// Simulated JWT generation (use actual JWT library)
function generateJWT(user) {
  // In production: use jsonwebtoken library
  return 'jwt-token-placeholder';
}

const PORT = process.env.PORT || 3000;
app.listen(PORT, () => {
  console.log(`Server running on port ${PORT}`);
});