# lets-mfa-express

> LetsMFA bindings for ExpressJS

Latest version **0.1.99** (published 2025-07-10) · ISC license · 0 weekly downloads

## Install

```sh
npm install lets-mfa-express
pnpm add lets-mfa-express
yarn add lets-mfa-express
bun add lets-mfa-express
```

## Health

**Score 30/100 (F)** — status: maintenance-mode.

Positive: has types; no vulnerabilities.

Warnings: low downloads; no esm support; pre 1.0.

Negative: stale; low maintenance score.

## Facts

| | |
|---|---|
| Version | 0.1.99 |
| Published | 2025-07-10 |
| First published | 2023-06-08 |
| Weekly downloads | 0 |
| License | ISC |
| TypeScript types | bundled |
| Module format | CommonJS |
| Dependencies | 4 |
| Unpacked size | 23.9 KB |
| Known vulnerabilities | 0 |
| Install scripts | no |
| Author | LetsMFA.com |
| Maintainers | dreamingwell |

## Links

- npm: https://www.npmjs.com/package/lets-mfa-express
- npm.io page: https://npm.io/package/lets-mfa-express

## Dependencies (4)

- [nocache](https://npm.io/package/nocache.md) ^4.0.0
- [lets-mfa](https://npm.io/package/lets-mfa.md) 0.1.99
- [cookie-parser](https://npm.io/package/cookie-parser.md) ^1.4.6
- [lets-mfa-rp-lib](https://npm.io/package/lets-mfa-rp-lib.md) 0.1.99

## Recent versions

- 0.1.99 (latest) — 2025-07-10
- 0.1.100 — 2025-07-10
- 0.1.98 — 2025-04-04
- 0.1.97 — 2025-04-04
- 0.1.96 — 2025-04-04
- 0.1.95 — 2025-02-10
- 0.1.94 — 2025-02-10
- 0.1.93 — 2025-02-10
- 0.1.92 — 2025-02-10
- 0.1.91 — 2025-02-10
- 0.1.90 — 2025-02-04
- 0.1.89 — 2024-05-16
- 0.1.88 — 2023-09-05
- 0.1.87 — 2023-08-31
- 0.1.86 — 2023-08-31
- … 47 more at https://npm.io/package/lets-mfa-express/versions

## README

#Lets MFA Express Bindings

A simple way to add MFA to your Express app.

# Use Case

Use this library to add MFA protection to your Express app. This library will add the necessary routes to your Express app to handle the MFA flow. It will also add a middleware to your app that will check for a valid id_token on the request. If the id_token is not valid, the middleware will allow you to redirect the user.

## Installation

```bash
npm install --save lets-mfa-express
```

## Generate Keys

Before you can use the library, you must generate a public/private key pair. This can be done with the following command. The keys will be written to the current directory. The private key is a secret and should be stored securely.

```bash
npx lets-mfa-express generate-keys
```

## Usage

The following is a simple example of how to use the library. This will add MFA protection for the `coveredPaths`.

```javascript
const express = require("express");
const app = express();
const letsMfa = require("lets-mfa-express");
const { existsSync, readFileSync } = require("fs");

// Read the keys from the file system
// Better yet, you should store these in a secrets manager
const publicKeyPath = "public-key.json";
const privateKeyPath = "private-key.json";
if (!existsSync(publicKeyPath) || !existsSync(privateKeyPath))
  throw new Error("Must generate keys first");

const keys = {
  publicKey: readFileSync(publicKeyPath).toString(),
  privateKey: readFileSync(privateKeyPath).toString(),
};

// This adds LetsMFA bindings to your express server
// It should be called before any other routes are added
new LetsMFAExpress(app, {
  // The paths that will be protected by MFA
  coveredPaths: ["/protected"],

  // The domain for the user account
  domain: "example.com",

  // The base URL for your express app
  // The hostname must be part of the domain above
  baseUrl: RESPONSE_URL_BASE,

  // The keys from above
  keys: {
    publicKey: keys.publicKey,
    privateKey: keys.privateKey,
  },

  // The URL to the logo that will be displayed on the MFA page
  logoUrl: "http://localhost:4000/static/logo.png",

  // Called after successful authentication
  authResponseHandler: async (req, res, response) => {
    // Get the User object from the database by username
    let user = getUserFromDB(response.sub);

    // Update the user's "accountVault" with the response
    user.accountVault = response.accountVault;

    // Save the user back to the database
    saveUserToDB(user);

    // Send the user to wherever they need to go after completing MFA
    res.redirect(301, "/");
  },

  // Called when a user visits a 'coveredPath' without having
  // a valid LetsMFA id_token
  invalidAccessHandler: async ({
    req,
    res,
    next,
    client,
    idTokens,
    validation,
  }) => {
    // If the user is not authenticated, respond or redirect
    // the user appropriately
    res.status(401).send("Not Authorized");
  },
});
```

---
_Source: https://npm.io/package/lets-mfa-express · Machine-readable twin of the npm.io package page. Health data is recomputed on every publish._