Multi-Factor Authentication for Web Applications Using JWT and Face Embedding-Based Recognition

Stateless authentication using JSON Web Tokens (JWT) has become widely adopted in web applications over the past decade. Typically, this method relies on a single authentication factor, namely a username and password, which makes it vulnerable to password theft. This paper proposes a multi-factor authentication system that integrates JWT with face recognition for enhanced security. The first step involves user authentication via username and password using JWT. Next, face identification is performed using a face embedding approach on the web page. If both authentication factors are validated successfully, the user is granted access to protected resources. The system is implemented as a web authentication prototype for experimental validation. The dataset includes 30 individuals, each with 15 facial images, resulting in a total of 450 facial images. Additionally, 100 unknown faces are used for evaluating the system's performance on an unknown class. The results show high accuracy in face identification, with an overall performance metric of 0.95.