iSpeed.my — Authentication & MFA Flow

Login, session creation, and device-based MFA challenge

iSpeed.my — Authentication & MFA Flow Login, session creation, and device-based MFA challenge Open login POST /member login (90019) vbAPI.login validate credentials login result store USER_SESSION bV_SessionID + flags Logged in MFA challenge (90040) create challenge send push device approved (WebSocket) MFA0124 + session Session ready Login MFA Challenge User · Trader · Sequence participant User Trader React Native App · Expo SDK 56 · Sequence participant React Native App Expo SDK 56 Mobile API · rt-mx-mobile-api · Sequence participant Mobile API rt-mx-mobile-api AuthConn · USER_SESSION · Sequence participant AuthConn USER_SESSION MFA DB · mfa_devices_users · Sequence participant MFA DB mfa_devices_users VBroker API · /vbroker login · Sequence participant VBroker API /vbroker login FCM Push · Firebase · Sequence participant FCM Push Firebase Legend request return security async trace default message

Session Store

  • • Sessions live in USER_SESSION (authorisation DB)
  • • Mobile sessions keyed by bV_SessionID
  • • Web sessions use a JSESSIONID cookie

Single Session

  • • SessionTerminationService keeps one session per platform
  • • Build values: android-phone, iphone, web-pc
  • • MFA approval terminates other mobile sessions

MFA Security

  • • Device-bound OTP and WebSocket challenge
  • • FCM channel ispeed.rakuten.my.fcm.alert.ANDROID_MFA
  • • Challenge timeout defaults to 40 seconds