Implementing a secure two-factor authentication for a login page with Django form wizard -

so want achieve similar google two-factor authentication implementation. login form consists of 2-step form wizard:

1. step 1 (verifying username , password)
2. step 2 (authenticate security token)

the usage scenarios be:

1. user has security token associated account: logs user in if user passes step 1 , step 2
2. user doesn't have security token: logs user in right after passes step 1 only

i'm subclassing django's form wizard used login view. in step 2, default django formwizard include field values submitted forms hidden fields. know, password entered in step 1, don't want include in step 2 security reasons.

my first thought use session indicate if user has passed step 1, don't need include field values step 1.. may overlooking here. more secure solutions this?

also don't quite understand use of security-hash in formwizard. can explain?

thanks lot.

i'm not getting point of security token, seem simpler , faster if forgo extending formwizard , implement 2 separate views. whole point of formwizard break , aggregate several forms 1 , particular use case goes against it—you'd hacking functionally otherwise.

as security hash, calculates hash of form data completed steps. security measure ensure form data has not changed/been tampered inbetween steps , none of steps otherwise bypassed somehow.