Case Study: TanStack Start adds MFA and step-up authentication with WorkOS

TanStack Start adds MFA and step-up authentication with WorkOS in minutes

TanStack Start, a framework for building web applications, needed to implement robust multi-factor authentication (MFA) to protect sensitive server functions, moving beyond just securing the initial login. Their challenge was to add both TOTP-based MFA at sign-in and, more critically, step-up authentication to ensure high-stakes operations required a fresh verification, regardless of how long ago a user had logged in. They turned to WorkOS and its AuthKit product to address this security need.

WorkOS provided a complete solution, enabling TanStack Start to easily add MFA through a hosted flow and a developer-friendly API. The implementation included a dashboard toggle for mandatory MFA enrollment and programmatic controls for optional user-managed MFA. Crucially, WorkOS delivered a first-class step-up authentication feature using the `auth_time` claim and `max_age` parameter, allowing TanStack Start to gate sensitive server functions and force re-authentication when necessary. This combination of MFA at login and step-up authentication for specific actions provided comprehensive protection against multiple attack surfaces, enhancing the overall security of applications built with the framework.

TanStack Start