The request
“Login with two-factor authentication: check the credentials and show an error on a wrong one; if 2FA is enabled, ask for a code and retry on a wrong code, then log the user in.”
Then tryLock the account after three failed codesAdd a remember-this-device option
What is in this drawing
Read the decisions behind it.
01
Should 2FA be enabled?
02
Is the credential valid?
03
Is the 2FA code correct?
This flowchart can be reused for documenting or explaining any login process that includes an optional second factor.
More like this