UNITY, ME - Cobalt Engine, the free and open source web design engine created by Heavy Element, has received a major new update which includes full Two-factor Authentication (2FA).

2FA is a way to secure your user accounts by relying on more than a simple password check.

Learn more about setting up 2FA and using it to secure your account.

Usage

The first step is to log into your Cobalt app by heading to the /login page. At the login screen, you'll be asked for your username or email address.

You'll then be prompted for your password.

Once you've supplied your password, one of two things will happen. If you have 2FA enabled on your account, you'll be asked for a one-time password. This one-time password (or OTP) is generated by your OTP app. Apps like Google Authenticator or FreeOTP are excellent options. We recommend Free and Open Source applications like FreeOTP.

However, if you haven't set up 2FA for your account, Cobalt will prompt you to set it up.

Given the security implications of not enabling 2FA, you will see this prompt every time you log in to a Cobalt Engine application.

Set Up 2FA

If you clicked "No, thanks" on the 2FA prompt screen, you can set up 2FA through the admin panel.

From the admin panel, click the options menu next to your username.

The menu button will open a "User" menu. Select Edit Profile from this menu.

On this screen, select the Security tab (on the left on desktop, scroll the tabs at the top of the screen on mobile). Scroll down to the Enroll in Two-Factor Authentication (2FA) section.

Using the authenticator app on your phone, scan the QR code (or manually enter the code).

Once your Cobalt App is registered with your authenticator app, tap on the listing for your app to generate a One-Time Password.

Quickly type that code into Step 2 of the Enroll in Two-Factor Authentication (2FA) section.

Then, press the Activate 2FA button. You'll be prompted to enter your password to confirm this action.

Finally, you'll be shown a set of backup codes which can be used in place of a One-Time Password if you don't have your 2FA app available.

You'll only see these backup codes once, so make sure you back them up somewhere secure! (Store them in a trusted password manager, for example.)

Congrats! Now you're all set up.

Notice to Heavy Element Customers

If we've built a website for you, we encourage you to take advantage of this enhanced security feature!

If your admin panel does not match the above instructions, we've probably pinned your app to a known stable version of Cobalt. Please contact us and we'll get you upgraded ASAP.