Software Design

MFA Verification Flow and Rate Limiting

State Diagrams · made in Skemio

State machine illustrating Multi-Factor Authentication: ChallengeIssued, AwaitingInput, Choice check, Authenticated, and LockedOut states.
State machine illustrating Multi-Factor Authentication: ChallengeIssued, AwaitingInput, Choice check, Authenticated, and LockedOut states.
Open it in SkemioMake your own

What it shows

  • A 6-digit code has 1,000,000 combinations—brute-forceable in 20 minutes.
  • Rate limit counters must be stateful and tied to session ID and IP hash.
  • Lockout transitions mitigate distributed credential stuffing attacks.

The takeaway

Enforce short TTLs, attempt limits, and temporary account lockout directly inside the auth state machine.

More state diagrams