No MFA backup/recovery codes

[roshankumar0036singh]

Issue #17 - No MFA backup/recovery codes

Type: Feature Request
Severity: P2

Description

When MFA is enabled, no backup recovery codes are generated. If a user loses their TOTP device (phone lost/broken), they are permanently locked out of their account.

Expected Behavior

Generate 8-10 one-time-use backup codes when MFA is enabled. Store them hashed in the database. Allow users to use a backup code in place of a TOTP code during login.

Acceptance Criteria

• Backup codes generated during MFA setup
• Codes returned to user only once (during setup)
• Codes stored hashed in database
• POST /api/auth/login/mfa accepts backup codes as an alternative
• Used backup codes are marked as consumed

[Rudra-clrscr]

@roshankumar0036singh Can i be assigned this issue as Ssoc'26 contributor ?

[Trishanthsai]

Hi @roshankumar0036singh i would like to work on this if possible could u assign it to me

[Trishanthsai]

Hi @roshankumar0036singh is there any changes needed in the pr let me know!!

[Trishanthsai]

Hi @roshankumar0036singh any updates on this !!