Fac-360
Identity

Start TOTP enrolment

POST
/console/v1/mfa/enrolment

Authorization

consoleSession
__Host-apf_console<token>

Set by POST /console/v1/sessions. HttpOnly, Secure, SameSite=Strict, Path=/, __Host- prefixed. It is never readable by JavaScript and there is no header alternative: accepting both carriers would let an attacker choose the weaker one.

In: cookie

Response Body

application/json

application/json

application/json

application/json

application/json

application/json

application/json

application/json

application/json

application/json

application/json

curl -X POST "https://example.com/console/v1/mfa/enrolment" \  -H "Authorization: Bearer apf_v2_tu_credencial"
{  "schemaVersion": "console.1",  "requestId": "d385ab22-0f51-4b97-9ecd-b8ff3fd4fcb6",  "secret": "string",  "uri": "string",  "qrPngDataUrl": "string"}

Change the password POST POST

Compare-and-swap against the hash just verified, so a change racing another loses instead of silently overwriting it. EVERY session dies, the caller's included: a password change cannot be distinguished from the response to a compromise, and the rule that is right in the second case is the one that applies to both.

Finish TOTP enrolment POST POST

The secret is sealed with AES-256-GCM under a versioned KEK, and the step the enrolling code used is recorded with it, so replaying that same code cannot also open a session.