What HTTP status to use in 2 factor authentication

Question

My website workflow is that the user submits their username and password, then if 2 factor authentication is enabled, my website will request the user to enter 2 factor token via modal dialogue.

My question is what HTTP status code should I use to notify jQuery to prompt the user to enter the 2 factor token?

I'm thinking about 200 OK but that could be misleading since it'll be the same as a successful login. 100 Continue can also be a candidate but it that won't comply with RFC7231 at all.

Answer 1

A 200 response in this case doesn't have to mean the same as the successful login. Reading the RFC and presuming you are POSTing the username and password, the 200 response should have a payload that is "a representation of the status of, or results obtained from, the action". Your payload should therefore be different based on whether a user has successfully logged in or only passed the first step of the process.