title: How to add a two factor authentication in a RESTful webservice
body: <p>I have a pretty straight forward RESTful webservice to serve resources to the client. The only place where I am stuck is the Authentication in case of a password reset. </p>
  
  <p>The flow is:
  User enters email address and DOB. When these two get authenticated then the user is prompted with a security question. Now at this point I need to know that request with security answer is from a client who was previously authenticated with Email address and DOB. </p>
  
  <p>I read a few questions on it but I haven't gotten a clear answer on how to implement it. Here are some of the questions I have gone through</p>
  
  <p><a href="https://stackoverflow.com/questions/20127743/how-to-implement-two-level-authentication-in-a-restful-api">How to implement two level authentication in a RESTful API?</a></p>
  
  <p><a href="https://stackoverflow.com/questions/41814194/how-to-design-a-stateless-rest-login-with-2-factor-authentication-2fa">How to design a stateless REST Login with 2 Factor Authentication (2FA)?</a> (This one does not have an answer)</p>
  
  <p>What I have in mind is: 
  Once the user's Email and DOB are authenticated then server will return an Auth token in response which on client side will be passed on to the next request (May be in header or something) - The Auth token will be stored in DB with an expiration period and when the next request with security answer comes, the Auth token from the header will be read and validated. </p>
  
  <p>But my problem  is I am not really sure if this is the correct way to do achieve the functionality I intend to. </p>
  
  <p>This might seem like a suggestion question but I what I am exactly asking is, if this is the best way to do what I intend to or is there another way I should be implementing this in case of a RESTful webservice. </p>
  
  <p>I would really appreciate if someone can point me to some examples if there is a better way to do this. </p>
  
  <p>Thanks in advance.  </p>