Authentication
Authentication system overview for TMA Cloud.
Authentication system overview for TMA Cloud.
Authentication Methods
TMA Cloud supports multiple authentication methods:
Email/Password Authentication
- Secure password hashing with bcrypt
- JWT token-based sessions
- httpOnly cookies for token storage
Multi-Factor Authentication (MFA)
- TOTP-based (Time-based One-Time Password), 30-second steps
- QR code setup
- Optional per-user
- Backup codes as fallback: 10 codes, 8 characters each, single-use, stored hashed and replaceable
- Replay-protected: the time step a code belongs to is recorded, and a step that has already been spent is refused. Only the current step and the one before it are accepted, so a code is valid for at most one minute and only once
Session Management
Token Structure
- JWT tokens with expiration
- Token versioning for revocation
- Session ID bound to the token, so single sessions can be revoked
Session Lifetime
Sessions expire after a period of inactivity, not a fixed period after login.
- Tokens are issued for the idle window, 30 days by default
- While the user is active, the token is re-issued before it runs out, so an active user is not logged out mid-use
sessions.last_activityis updated on each authenticated request and is what the idle check reads- After the idle window passes with no requests, the session ends and the user logs in again
The first user sets the window under Settings → Administration → Session timeout, from 1 to 365 days. A change applies to existing sessions without a restart. See Session Timeout and Recently Opened.
Active Sessions
- View every valid session with device, IP, creation time, and last activity
- Refresh the list without its two-minute cache to read the latest reported IPs
- See Online only when a visible page or desktop window sent a session heartbeat in the last three minutes; hidden pages pause heartbeats, and recent request activity alone does not count
- Sign out individual devices
- Logout from all devices
- Browser and desktop clients report presence every two minutes while signed in
Security Features
- Token Versioning: Invalidate all tokens on logout-all
- Rate Limiting: 25 login/signup attempts per 15 minutes per IP/email; failed logins also limited to 100 per 15 minutes per IP and 20 per 15 minutes per account; MFA verify/disable 5 attempts per minute; backup code regeneration 3 attempts per 10 minutes with 5-minute cooldown. See Rate Limits
- Login Timing: Unknown emails and accounts with no password still run a bcrypt comparison, so response time does not reveal which emails have accounts
- Audit Logging: All authentication events logged
- Password Change: When enabled by the admin, users change their own password from Settings → Security. Two gates apply before the change is accepted: the session must be less than 10 minutes old, and an MFA or backup code is required when MFA is on. On success every session and token for that login is invalidated
Sub-user Logins
Sub-users authenticate the same way as any other account: their own email and password, their own MFA, and their own sessions. Logging out or changing the password on one login does not affect the others on the same account.
What differs is what the login can reach — see Authorization.
First User Privileges
The first user to sign up becomes the administrator. See Authorization for what that allows.
Signup Control
The administrator turns registration on or off with Allow sign-up:
- On: anyone who can reach the server can create an account
- Off: nobody can create an account; account owners can still add sub-users
Related Topics
- Authorization - Access control and permissions
- Sub-users - Extra logins on one account
- Security Model - Overall security architecture
- API: Authentication - API endpoints
Last updated on