There are plenty of opportunities for friction in the user experience when logging in, particularly while entering a two factor authentication code. As developers we should be building applications that support the need for account security but don’t detract from the user experience. Sometimes it can feel as though these requirements are in a battle against each other.
In this post we will look at the humble
<input>
element and the HTML attributes that will help speed up our users’ two factor authentication experience.
The final markup to trigger the correct keyboard and have the browser autocomplete the received SMS code is this:
<input
type="text"
name="token"
id="token"
inputmode="numeric"
pattern="[0-9]*"
autocomplete="one-time-code"
/>
HTML attributes to improve your users’ two factor authentication experience →
🚨 Do note that 2FA using SMS is not secure, mainly due to the lacking policies at SIM providers easily allowing SIM port hacks. The recently announced origin-bound
OTP addition as proposed by Webkit/Apple won’t make any difference in the case of a SIM hack.
Leave a comment