c# - Securely implementing two factor authentication -

i'm looking implementing 2 factor authentication in mvc, similar googles authenticator.

since users won't have 2 factor authentication setup, want use 2 step process - 1 screen enter username , password, other screen enter 1 time password.

my difficulty how securely store users username , password whilst entering 1 time password? receive password , reject or issue cookie, don't store password anywhere. however, 2 step can't issue cookie because user navigate action. equally, don't want send password user hidden element in form.

what standard practice situation?

the best can think of store username , password in session, i'm not sure how secure is.

actually, don't need store password , wait authentication until second step passed. can implement 2 steps of authentication separately (each step usual authentication: authenticate or reject), , grant appropriate authorities users passed first step , second step accordingly.

specifically, can create own authorize attribute authorizeconfirmedattribute derived authorizeattribute , use second step of authentication. so, in controller generate screen enter 1 time password use usual [authorize] attribute, ensuring user passed first step of authentication. in other actions use [authorizeconfirmed] attribute ensure user passed both steps of authentication.