Why this article? I try to evaluate how easy vibe coding is with Liferay.
I ask ChatGPT and/or Claude to generate a Liferay module from scratch with a single sentence.
First, I use my mobile and the ChatGPT website with a free license. All AIs know Liferay; the important thing is to specify the version. In my case I put 2025.q1, but 2026.q1 is also possible, since it has been available for a few months now.
ChatGPT easily gives me an OSGi module. I simply look at it (always on my mobile when I have time) and ask it to add unit tests, use a fragment, expose an endpoint...
Afterwards, I evaluate and test the generated code in a real environment. I use Cursor to adapt the modules to my Liferay 7.4.132 CE (same as 2025.q1), and here I spend hours improving the code but I work no code, I ask to Cursor to do what I want.
The main problem is authentication: after a user enters their email and password, a session is created and the OTP screen is shown. I need to secure this and create the user session only after OTP validation.
Finally, I  create my github repository and ask to write this article based on this generated GitHub repository (always on my phone).

1. The project in a nutshell

lfr-totp-auth is an open-source project that adds a second factor authentication based on TOTP to Liferay 7.4 CE (and versions 2025.Q1+ and 2026.Q1+). It uses OSGi services and does not rely on ServiceUtil (ServiceBuilder).
The project is organized around three modules:

2. The principle: don't create the session too early

The heart of the project is a simple idea:
"Password valid ≠ User authenticated".
The password is validated, but the session is not created yet after verifying the second factor (TOTP).
The authentication workflow (diagram):
Email + password
Password validated (no session yet)
TOTP valid
Authenticated
User → Liferay → TOTP Authenticator → TOTP Verification → Session created

ℹ️ The password is valid. The TOTP is a separate check.

3. General architecture

The project clearly separates the responsibilities: UI, API and business logic.

Diagram:

User → fragments totp-setup (fragment) and totp-verify (fragment) → REST API: TOTPRestApplication (JAX-RS) — /o/totp/api
OSGi · TOTP Authenticator: TotpLoginMVCActionCommand, TotpTwoFactorLoginService, TOTPLoginFilter, TotpPendingLoginUtil, TOTPService, TotpRoleChecker
Liferay: User Session, User / Expando, System Settings

4. TOTP setup

If the user is not yet configured for TOTP, they are redirected to the setup page. The totp-setup fragment calls the API to generate the QR code and backup codes.

TOTP setup sequence (User, totp-setup (fragment), REST API, TOTPService, Expando):
GET /setup/init
Generates secret and backup codes
QR code + backup codes
POST /setup/confirm
Verifies code and stores secret
Confirmation

5. The complete workflow

Here's the global flow, from the user's perspective, once the setup is configured.

Login flow (diagram):
Login (email + password) → Password validated (no session) → diamond "TOTP configured?"
No → Setup → MFA validated → Session created
Yes → TOTP Verification → MFA validated → Session created

6. Data storage

The TOTP secret and backup codes are stored in custom fields (Expando) for the user.
Diagram: User → Custom Fields / Expando: totpSecret (Base32), totpBackupCodes (BCrypt)

7. Backup codes

Five backup codes are generated and stored as BCrypt hashes. They are used once and must not be reusable.
Diagram: Backup code (XXXX-XXXX-XXXX-XXXX) → BCrypt → Hash stored → Verification →
Valid → Login
Invalid → Rejected

8. REST endpoints

The JAX-RS application exposes a small set of endpoints :

9. What's next?

The project is a solid foundation and could be used in production, because it is a complementary step to the basic login.

What we can still improve:

• rate limiting and brute-force protection,
• MFA event auditing,
• account recovery procedures,
• adapt the code to Liferay 2026.q1 version

10. The final word

The vibe coding isn't just about writing code. It's about asking the right questions.

"The code is easy. The workflow is difficult."
— Eric Dariel

The project is open source under the Apache 2.0 license.
Here is the link : github link

Here a all in one image generated by ChatpGPT :