title: 2-Step Authentication in ASP.Net MVC
body: <p>I am working on an ASP.Net Mvc 3 application using <code>FormsAuthentication</code> with a custom <code>MembershipProvider</code> (so I do have some control over what the provider returns).</p>
  
  <p>The requirements mandate a 2-step authentication process (username and password followed by secret question). A user should not be able to access any of the "secure" sections of the site without passing both steps. Please don't mention whether this is multi-factor security or not, I already know.</p>
  
  <p>Please provide a recommendation on how to best accomplish this task.</p>
  
  <p>Here are some considerations:</p>
  
  <ul>
  <li>I am allowed (architecturally) to use session - would prefer not to.</li>
  <li>I would prefer to use the out-of the box <code>[Authorize]</code> <code>ActionFilter</code> for Controllers providing secure content.</li>
  <li>The people in charge would like for the url for the 2 steps to be the same: i.e. <code>www.contoso.com/login/</code>. In my attempts at least, this has caused some minor-but-not-insignificant issues when users enter an incorrect answer in the second step (they are not officially logged in, but I need to ensure that I am still working against the half-authenticated user's secret question/answer).</li>
  </ul>
  
  <p>Thanks.</p>