Modern systems need robust authentication, and simple passwords won't do. The general consensus in the security community is that you SHOULD use two-factor authentication, and you've experienced it: it's required on Github. Spring Security finally added support for multi-factor authentication (MFA) in version 7, and you can implement it in your apps in just a few lines. No more copy-pasting tons of code from dubious articles on Medium!

MFA goes beyond the simple "type password, copy one-time code" flow that most users know. There are more available factors that can be combined, and rules can be adaptative: for example, to change your password, you must first re-type your current password.

In this talk, we'll create a secure Spring app from scratch, with different MFA constraints. You'll learn the usual patterns for MFA, when you should use them, and how to apply them in practice in all your Spring apps.