KO | EN

GitLite

Minimalist Open Source Repository Search Engine

gitlite — search

#dsh #dsh-plugin #typescript #ai-agent #developer-tools #claude-code #codex #deepseek-harness #ai-agents #react #mcp #rust

web

★ 39 Open GitHub ↗

Safely enable 2FA on your CI published packages. Built with ❤️ by The Electron Team

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

# CFA: Continuous Factor Authentication

> [!WARNING]
> **In light of [planned changes to npm token management](https://github.blog/changelog/2025-09-29-strengthening-npm-security-important-changes-to-authentication-and-token-management/) announced by GitHub, the Electron team has decided to deprecate the Continuous Factor Authentication project.**
>
> **We recommend migrating your projects to [Trusted publishing for npm packages](https://docs.npmjs.com/trusted-publishers).**

[![GitHub Workflow Status](https://img.shields.io/github/actions/workflow/status/continuousauth/web/ci.yaml?branch=main&label=CI&logo=github&style=for-the-badge)](https://github.com/continuousauth/web/actions/workflows/ci.yaml)

This service is responsible for safely requesting and delivering a 2FA token to an arbitrary CI job. Typically though a tool like `semantic-release`.

## Usage

Head over to https://continuousauth.dev and sign in to start using CFA.  You can also check out our [usage documentation](https://docs.continuousauth.dev) for more information on how to use CFA and what it does.

## What does it look like?

Something like this:

![CFA Example](https://raw.githubusercontent.com/continuousauth/web/main/docs/example.png)

## How does it work?

At a high level CFA is just a proxy for 2FA, in a 2FA model there is "something you know" and "something you have".  In the CFA model the "something you know" is still your NPM auth token, and the "something you have" is still the OTP generator.  CFA just safely mediates a connection between the CI build and you by validating the CI build through both a CFA token and by forcing the CI build to "prove" it is actually asking for a token.

Included below is a flow diagram which explains what CFA verifies and how it verifies it.  Other important parts of the code for this verification process can be found in each `Requester` implementation [`src/server/requesters`](src/server/requesters).

![Proof Process](https://raw.githubusercontent.com/continuousauth/web/main/docs/proof-process.png)

## Heroku Configuration

You should probably just use the hosted version of CFA at https://continuousauth.dev but if you really want to deploy it yourself these are things you need to do.

The following environment variables need to be set:

* `PORT`: Which port to run on (`3000` by default)
 * `SLACK_CLIENT_ID`: Slack app id
 * `SLACK_CLIENT_SECRET`: Slack app secret
 * `SLACK_SIGNING_SECRET`: Slack app signing secret
 * `GITHUB_CLIENT_SECRET`: GitHub token that allows `electron-bot` to clone `electron`
 * `GITHUB_CLIENT_ID`: Same GitHub token as above
 * `SESSION_SECRET`: Secret to use for web UI session tokens
 * `DATABASE_URL`: In prod, use this to set a postgres connection URL

Optional variables:

* `DEBUG`: Used by tons of modules used by the bot, set it to `*` for verbose output

web

Explore Similar Repositories

Was this content helpful?

Recent Feedback

Download README