We have a client with fairly extensive security requirements. They have asked us if it is feasible to implement something like Authy in Craft.

I'm provisionally planning to disable the "normal" CP login form and implementing a new login flow via a plugin that checks the OTP first and then hands off to UserSessionService for the actual login. Is there any reason that wouldn't work?

If it will, what's best way to effectively disable the default CP form and direct users to the plugin's form instead?

Lastly, are there any gotchas that I should look out for in terms of maintaining as close to "normal" Craft behaviour as possible.

PS I know there's the userSession.onBeforeLogin event, but unless I'm missing something, that looks fairly limited (only receives the username of the User as a param etc)

  • Any reason why you want to check the OTP first? I would think that using Craft's own login form, then using the userSession.onBeforeLogin event to handle the Authy check would be a simpler way to do it. Oct 13, 2016 at 10:59
  • @SteveRowling Totally open to that approach as much simpler I agree. I just couldn't see how to redirect to / render the UI I need to capture the OTP from the user from within my userSession.onBeforeLogin handler. That could well be an error on my part though...
    – Tom Davies
    Oct 13, 2016 at 14:01
  • True, it's tricky. Rendering a template and processing the resulting OTP check means generating a new request that I guess will break passing back anything to the original userSession.onBeforeLogin event. How about using the userSession.onLogin event instead? That way you know they have been authenticated by Craft. You can then set a redirect to a second form to check the OTP. If that fails, then you can logout the user by calling craft()->userSession->logout(false); Oct 13, 2016 at 14:42
  • Actually for get my previous comment. Just realised that a user could just bypass the second form and remain logged in - not what you want! Oct 13, 2016 at 14:44
  • Ideally for this type of thing we'd have a way for a plugin to inject their own contents into the actual CP login form. A semi-related feature request here: craftcms.uservoice.com/forums/285221-feature-requests/…
    – Brad Bell
    Oct 13, 2016 at 17:42

1 Answer 1


I know this is a little late, but i've just build a plugin for TOTP. It is in beta, so beware before using it in a production environment. https://github.com/born05/craft-twofactorauthentication

  • Nice, obviously still early days, but this seems like a neat way to work around the current Craft 2 login process. Still hoping that down the line after 3 ships we'll get hook to inject markup into the login form itself, but this is a great start.
    – Tom Davies
    May 7, 2017 at 20:32
  • @TomDavies i'm hoping for the same. In the meantime there is an issue about this on Github github.com/craftcms/cms/issues/1471
    – Roel
    May 8, 2017 at 11:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.