title: Implementing Two Factor Authentication Using Devise
body: <p>I am trying to Implement Two Factor Authentication on <a href="https://github.com/plataformatec/devise" rel="nofollow noreferrer">Devise</a> Using a Gem <a href="https://github.com/tinfoil/devise-two-factor" rel="nofollow noreferrer">devise-two-factor</a>. I want the Authentication to be in 2 Steps for that in First i am going to ask for Username and Password. if the User passes this step then he will be redirected to Next page of OTP if 2FA is Activated else the Session will be verified by Devise.</p>
  
  <p>If the User has opted for 2FA then I want to use the Devise to do all the Authentication and don't want to use sign_in(user) function to create session if user.validate_and_consume_otp(CURRENT_OTP) is true. I want to Pass Username Password and OTP to Devise as Params, So that Devise will handle the Authentication of all the three params without my intervention.</p>
  
  <p>For doing so I have came up with some workflows :-</p>
  
  <ol>
  <li><p>If username and Password are Valid and Correct i will Pass these as Post Params and Have Username and Password as hidden fields along With OTP that the User will Fill and After the Submit, These three params will be sent to Devise for Validation.</p></li>
  <li><p>I first verify the Username whether that exist in users table or no, If it exists I will check for the Valid Password using the Devise default function user.valid_password?("YOUR_PASSWORD_COMES_HERE") if both these conditions are true i will be Passing the email of User as Session Variable to Next step and In second Step i only verify for Correct OTP (as username &amp; password validation is done in step 1) if OTP is correct we create Session for the User with the Email passed as Session variable and Delete Session after succesfull login, else we will again ask for OTP.</p></li>
  </ol>
  
  <p>Can you Suggest any Better Work Flow ?</p>