HIGH: MFA backup codes returned in plain text with no shown-once-only enforcement

[Senthil455]

Summary

MFA backup codes are returned in the API response body with no mechanism to ensure they are only shown once. Anyone who intercepts the response has permanent access to the account.

Affected File

services/auth-service/index.js:842-861

Root Cause

// MFA setup returns backup codes in plain text
res.json({
    success: true,
    backupCodes: generatedCodes  // Printed once, but no "shown only once" enforcement
});

Backup codes are designed to be one-time-use recovery codes. Best practice requires:

• Showing them to the user exactly once
• Requiring the user to confirm they've saved them (e.g., "I've saved my backup codes")
• Never returning them again via API

Impact

• If an attacker intercepts the MFA setup response, they have permanent backup codes
• Backup codes stored in browser history, proxy logs, or API monitoring tools
• User cannot rotate backup codes without disabling and re-enabling MFA
• No confirmation that user actually saved the codes

Fix Required

1. Add a "shown once" flag in the database
2. Never return backup codes after the initial setup
3. Require user confirmation before completing MFA setup
4. Add a separate API endpoint for rotating backup codes with re-authentication

[Senthil455]

Fixed in PR #118 - Added backup_codes_shown flag; codes returned once only; /mfa/rotate-backup-codes endpoint with TOTP re-auth