title: Securely implementing two factor authentication
body: <p>I'm looking into implementing two factor authentication in MVC, similar to Googles authenticator.</p>
  
  <p>Since some users won't have two factor authentication setup, we want to use a two step process - one screen to enter the username and password, the other screen to enter the one time password.</p>
  
  <p>My difficulty is how do you securely store the users username and password whilst they are entering their one time password? Currently we receive the password and immediately reject or issue a cookie, so we don't store the password anywhere. However, with two step we can't issue a cookie immediately because the user could then simply navigate to another action. Equally, I don't want to send the password back to the user as a hidden element in a form.</p>
  
  <p>What is the standard practice for this situation?</p>
  
  <p>The best I can think of is to store the username and password in the session, but I'm not sure how secure that is.</p>