ASP.NET Core Identity 2FA with Authenticator app in ASP.NEt Core Web API

For temporary token you could generate random string with the expiration time. by using this token you can maintain the state between login and 2FA verification.

sample code:

2FA Initiation:

public IActionResult Login(LoginModel model)
{
    // ... Login code

    if (IsTwoFactorRequired(user))
    {
        var twoFactorToken = GenerateTwoFactorToken(user.Id);
        // Save the token somewhere e.g database, with expiration time
        StoreTwoFactorToken(twoFactorToken);

        // Return this token to the client
        return Ok(new { twoFactorToken });
    }

    // ... Generate JWT if not using 2FA
}

Generate a token for the user, could be a GUID, or an encrypted value that contains the user ID:

private string GenerateTwoFactorToken(string userId)
{
    return Convert.ToBase64String(RandomNumberGenerator.GetBytes(64));
}

2FA Verification:

public IActionResult VerifyTwoFactor(string twoFactorToken, string twoFactorCode)
{
    if (ValidateTwoFactorToken(twoFactorToken))
    {
        // Get the user based on the Token
        var userId = GetUserIdFromToken(twoFactorToken);

        if (ValidateTwoFactorCode(userId, twoFactorCode))
        {
            // Generate JWT and return to the client
            var token = GenerateJwtToken(userId);
            return Ok(new { token });
        }
    }

    return Unauthorized();
}

Validate the format and, optionally, the existence of the token in the database or cache:

private bool ValidateTwoFactorToken(string twoFactorToken)
{
    // Token validation code
}

I was having the same issue (ASP.NET Core WebApi with Angular)

I had two methods to authenticate the user

• normal login: (email, password)
• provider: (google)

I implemented a method to enable TFA

but when TFA is enabled, and need to enter the TFA code from Google Authenticator.

cannot get the user data await _signInManager.GetTwoFactorAuthenticationUserAsync(); (cannot validate TFA)

so, the solution when you login send { withCredentials: true } in your request options to let ASP add a cookie in your browser also when sending the request to validate TFA

do not forget to .AllowCredentials() in your cors

method to normal login: SignInResult result = await _signInManager.PasswordSignInAsync(user: user, password: _user.Password, isPersistent: true, lockoutOnFailure: true);

with provider: SignInResult signInResult = await _signInManager.ExternalLoginSignInAsync(info.LoginProvider, info.ProviderKey, isPersistent: true);