I would like to implement the following use case:
- User lands on the login page
- User submits login credentials
- Credentials are validated and they are redirected to another page for inputting the multi-factor authentication token
- User submits multi-factor authentication token
- Token is validated and user is redirected into the application
My question is about stages 3-5 - What is the recommended method for keeping track of this user once they have entered their username/password but before they have entered their multi-factor authentication token. In order to validate the token there needs to be a way to know which user is making the request. There also must be a way to prevent attackers from skipping over the Username/Password part of the process.
What is the recommended way of solving this problem?