ASP.NET Core get partially authenticated user (i.e. correct username + password, but not yet 2FA)

Viewed 220

In ASP.NET Core (v5.0), is there a way to determine inside of a controller/pagemodel/middleware component, whether a specific HTTP request is made by a user who has successfully authenticated using their username+password, but has yet to go through their 2FA stage (assuming it's enabled)? So basically at the stage of the authentication process, where they've been redirected to the 2FA token input page after successfully entering their credentials.

The value of HttpContext.User.Identity.IsAuthenticated is only true if the user has authenticated all the way including with 2FA, which makes sense of course, since it's a boolean.

I've been trying to get any sort of status indicator of this login state using some combination of SignInManager, UserManager and IdentityUser objects, with no luck. These objects seem to only be available after a user has already successfully authenticated, which of course makes sense too.

My use case is that I'm writing a middleware component which filters all requests and redirect the user to input their 2FA token when trying to perform certain actions as an additional security measure. So I thought it'd be neater to also filter the initial login 2FA (if enabled by the user) through this middleware. If this isn't reasonable, then I'll just have to handle these two different applications of 2FA verification separately in my code, which will likely add a bit of redundancy (but not hugely so).

0 Answers
Related