I am looking for the database-free way how to validate a secret code that was sent to user's mobile phone by RESTful web app, in a 2-factor authentication process.
At step 1, the user provides login name and password that is validated with the data from the database. Now the system generates a code that is sent to user's mobile phone. For convenience, the code should be relatively simple, let's say 5 numeric digits. User must provide this code in order to complete the authentication process.
I'd like to avoid the trips to the database as much as possible, so I use JWT to keep the state. But it would be absurd to store the secret auth code in the JWT, because it can be easily extracted at the client side. Therefore, it should be stored in hashed or encrypted form. I am considering salting the secret code with strong salt (known only by the server) and then store the SHA256 hash of the result (bcrypt hash is no good here because it contains the salt). That would make the secret code hidden from any prying eyes, but still useful for validating the code when provided by someone who knows it. And the server can happily forget the code meanwhile.
Can this approach be considered secure for the given purpose?