I have a web app that uses JWT, however, now I want to add 2FA to it. So the workflow should be, the user tries to log in, I verify credentials and check if he has 2FA enabled, if he does then I send feedback from my auth API that the login was successful but that 2FA is required.
However, on the second step, after the user provides 2FA token, do I need to re-submit his credentials again and to verify credentials and 2FA at the same time again before I return JWT?
... or should I return even on the initial login JWT but with some flag in the payload that 2FA is required and that's not fully authenticated, and only when token verification is successful to remove that flag from JWT payload?