Skip to content

Security & 2FA

Two-factor authentication

TOTP 2FA is mandatory for staff (admins and technicians):

  1. On first login, the user is redirected to the enrolment page with a QR code.
  2. Scan it with any TOTP app (Google Authenticator, Authy, 1Password, Microsoft Authenticator…).
  3. Confirm with a code — done. Every subsequent login asks for the current code.

Requesters are not required to enrol.

Microsoft SSO (optional)

NexaDesk supports Entra ID (Azure AD) single sign-on. When enabled, users can sign in with their Microsoft account instead of a password. Configure the Entra application and set the SSO environment variables in .env.

Session management

  • Sessions use short-lived access tokens with revocable refresh tokens stored server-side.
  • Session duration is configurable in Settings → Branding; Remember me on the login form extends it.
  • A password reset revokes all of that user's sessions — reset links are single-use and bound to the requesting browser.

Platform protections (built-in)

  • Login, registration, 2FA, and password-reset endpoints are rate-limited
  • First-run configuration is gated by the setup token
  • File uploads are served download-only with a sandboxing policy — HTML can't execute in your users' browsers
  • The production database is bound to localhost only