For a frontend, i would like to implement MFA (with TOTP). I may be searching for the wrong keywords but i couldn't find the proper way to implement securely this solution. I was searching for a diagram flow for example such as:
- Request: POST to /login with credentials in JSON, Response 302 to /mfa
- Request: GET /mfa , Response /mfa
- Request: POST with credentials again and mfa code , Response 302 to /
- Request: GET to /, response 302 to / (user logged in)
Is there any RFC describing (https://www.rfc-editor.org/rfc/rfc6238) in details the implementation of such protocol or its up to the user to sniff other website's ssl to reverse engineer how they did it (which i did for github etc..). Just searching for the correct way to implement it, may be an already working framework? should i use cookies or is it fine to re-request the user and login along with the mfr code ( i noticed github at STEP 3 use authenticity_token=<base64token>&otp=<123456>
)
Thanks a lot for your help
PS; already made solution like login with google are not possible, i need to use my own user's db