alexandregz/twofactor_gauthenticator — pull request #4 by rjbs (2013-12-19 20:12:27+00:00)
Title: change how "has OTP-authenticated" is stored

1. store data in $_SESSION rather than preferences
2. store the time of last OTP auth, rather than a temporary flag

This goes to our discussion on #3.

It is key that we not only put things in the session, but also switch to a model where the key must always be present for login. We store the time of last login immediately on login to deal with the possibility that the 2FA_login entry in the session may still be present by some fluke. (I would have used a unique pre-existing per-login id, but I'm not aware of one.)