MFA Frontend 

Classification

mfa_frontend

Package name

causal/mfa-frontend

Version

1.3

Language

en

Description

Enable MFA (Multi-Factor Authentication) for Frontend accounts.

Keywords

MFA, multi-factor, 2FA, authentication, otp, one-time, secure, security, protection

Copyright

2023-2026

Author

Xavier Perseguers

Email

xavier@causal.ch

License

This document is published under the Open Publication License available from https://www.opencontent.org/openpub/

Rendered

Fri, 23 Jan 2026 08:44:52 +0000

The content of this document is related to TYPO3, a GNU/GPL CMS/Framework available from www.typo3.org.

Table of Contents

Introduction 

Screenshots 

Installation 

This extension may be installed like any other extension, either from the TYPO3 Extension Repository (TER) or from Packagist:

composer require causal/mfa-frontend

Usage 

This chapter describes how to take advantage of this extension from the user's point of view.

Management of MFA in the Backend 

When you edit a Frontend User (fe_users), you will see a new tab called "Multi-Factor Authentication". There, you can enable MFA for the user by toggling the switch and following the instructions:

Once you have enabled MFA for a user, you will have to enter a valid TOTP code together with toggling off the switch to disable MFA again.

Management of MFA in the Frontend 

This extension provides a plugin to manage the MFA settings for a logged-in user, that is, from the website itself.

Plugin "Two-Factor Authentication (2FA) Setup" 

You should start by editing your Template record to include the TypoScript template provided by this extension.

TypoScript Configuration 

You can do so like that:

1. Open the Template module within the Web section.
2. Select your root page template (usually the one with the world icon).
3. Make sure you are on the "Info/Modify" view (top selector).
4. Click on the button "Edit the whole template record".
5. Switch to tab "Includes".
6. Include "MFA Frontend (mfa_frontend)" within the "Include static (from extensions)" section.

Hint

If you already customized the look of the Frontend login plugin, you will probably need to adjust your own template with the one provided by this extension and drop the override suggested by this extension by adding this to your TypoScript setup:

plugin.tx_felogin_login.view.templateRootPaths.11 >

Copied!

or ensure that your own template has a higher index definition than "11".

Insert the Plugin 

1. Open the page where you want to insert the plugin.
2. Click the button to add a content to your page.
3. Choose "General Plugin" from the list of content elements (usually on the tab "Plugins").

4. Switch to the tab "Plugin" and choose "Two-Factor Authentication (2FA) Setup" from the list of plugins:

   
5. Add access restrictions (typically to logged-in users only) to the plugin or the page itself if necessary.

Now visit that page in the Frontend and you should see the plugin:

Applications 

In order to use the MFA feature, you need to install some Authenticator application. There are many of them, and they are available for all platforms.

Since this extension currently supports Time-based one-time password, you need to install an application that supports this algorithm.

This application may be a browser extension, a desktop application, or an app on your mobile device (smartphone/tablet).

If you look for an Authenticator application for your mobile device, we can name a few of them:

• Google Authenticator (iOS / iPadOS, Android)
• Microsoft Authenticator (iOS / iPadOS, Android)
• Twilio Authy (iOS / iPadOS, Android)

If however you already use a password manager, you may want to use it to store your MFA secrets. There are many password managers, but two well-known of them officially support storing MFA secrets together with your website's credentials:

• 1Password
• Bitwarden

If you use 1Password, you can use the following link to see how to configure OTP for an existing Login entry (username + password) you have in your vault: https://support.1password.com/one-time-passwords/.

Development 

This chapter describes some internals of the mfa_frontend extension to let you extend it easily.

CollectAllowedTablesEvent 

This event is triggered when the extension collects the allowed tables to react on. This is typically the case when it hooks into TYPO3\CMS\Core\DataHandling\DataHandler to check whether MFA (currently TOTP) may be enabled or disabled after editing a record and trying to save it.

If you want to use MFA for your own extension, you can listen to this event and add your own table(s) to the list of allowed tables (by default fe_users).

YourVendor\YourExtension\EventListener\MfaFrontendListener:
  tags:
    - name: event.listener
      identifier: 'yourVendor/yourExtension'
      method: 'collectAllowedTables'
      event: Causal\MfaFrontend\Event\CollectAllowedTablesEvent

<?php
declare(strict_types=1);

namespace YourVendor\YourExtension\EventListener;

use Causal\MfaFrontend\Event\CollectAllowedTablesEvent;

class MfaFrontendListener
{
    public function collectAllowedTables(CollectAllowedTablesEvent $event): void
    {
        $tables = $event->getTables();
        $tables[] = 'tx_yourextension_domain_model_yourmodel';
        $event->setTables($tables);
    }
}

CREATE TABLE tx_yourextension_domain_model_yourmodel (
    ...
    mfa mediumblob
);

<?php
defined('TYPO3') || die();

$tempColumns = [
    'tx_mfafrontend_enable' => [
        'exclude' => false,
        'label' => 'LLL:EXT:mfa_frontend/Resources/Private/Language/locallang_db.xlf:fe_users.tx_mfafrontend_enable',
        'config' => [
            'type' => 'none',
            'renderType' => 'MfaFrontendEnable',
        ]
    ],
    'tx_mfafrontend_secret' => [
        'exclude' => false,
        'label' => 'LLL:EXT:mfa_frontend/Resources/Private/Language/locallang_db.xlf:fe_users.tx_mfafrontend_secret',
        'config' => [
            'type' => 'none',
            'renderType' => 'MfaFrontendTotp',
        ]
    ],
    'mfa' => [
        'config' => [
            'type' => 'passthrough',
        ],
    ],
];

\TYPO3\CMS\Core\Utility\ExtensionManagementUtility::addTCAcolumns(
    'tx_yourextension_domain_model_yourmodel',
    $tempColumns
);

\TYPO3\CMS\Core\Utility\ExtensionManagementUtility::addToAllTCAtypes(
    'tx_yourextension_domain_model_yourmodel',
    'tx_mfafrontend_enable,tx_mfafrontend_secret',
    '',
    'after:password' // Add the 2FA after our custom field "password"
);

DefineIssuerLayerEvent 

This event lets you configure/override the issuer layer. You could use it to show your extension's name when you use MFA for your own domain model.

YourVendor\YourExtension\EventListener\MfaFrontendListener:
  tags:
    - name: event.listener
      identifier: 'yourVendor/yourExtension'
      method: 'defineIssuerLayer'
      event: Causal\MfaFrontend\Event\DefineIssuerLayerEvent

<?php
declare(strict_types=1);

namespace YourVendor\YourExtension\EventListener;

use Causal\MfaFrontend\Event\DefineIssuerLayerEvent;

class MfaFrontendListener
{
    public function defineIssuerLayer(DefineIssuerLayerEvent $event): void
    {
        if ($event->getTable() === 'tx_yourextension_domain_model_yourmodel') {
            $event->setLayer('Your Custom Name');
        }
    }
}

ToggleTotpEvent 

This event is triggered when some users uses the usage-plugin-setup to enable or disable the use of 2FA for their account.

Listening to this event allows you e.g., to synchronize the MFA status with some external system or your own domain model if you happen to relate Frontend users to some other domain model.

YourVendor\YourExtension\EventListener\MfaFrontendListener:
  tags:
    - name: event.listener
      identifier: 'yourVendor/yourExtension'
      method: 'toggleTotp'
      event: Causal\MfaFrontend\Event\ToggleTotpEvent

<?php
declare(strict_types=1);

namespace YourVendor\YourExtension\EventListener;

use Causal\MfaFrontend\Event\ToggleTotpEvent;

class MfaFrontendListener
{
    public function toggleTotp(ToggleTotpEvent $event): void
    {
        $frontendUser = $event->getUser();
        // Do something like synchronizing the MFA status using:
        // $mfa = $frontendUser->getRawMfa()
    }
}

ChangeLog 

The following is a very high level overview of the changes in this extension. For more details, read the online log.

Contribution and Links 

TER

https://extensions.typo3.org/extension/mfa_frontend

Packagist

https://packagist.org/packages/causal/mfa-frontend

Bug Tracker

https://github.com/xperseguers/mfa_frontend/issues

Git Repository

https://github.com/xperseguers/mfa_frontend

Translation

https://crowdin.com/project/typo3-extension-mfafrontend

Contact

@xperseguers