I have implemented Two factor authentication for customers.
So customer logins from frontend and if they have entered login details correct then they will be redirected to our two factor authentication page.
My question is now if user enter directly in URL http://mymagento.com/customer/account/index/ in new tab they are easily accessing their account without passing through two factor authentication.
I know to resolve this issue I need to add one more condition weather they have passed two factor auth or not. But I am not getting from where magento checks if customer session is valid or not ?
If I will get code from where Magento 2 is validating user session I will modify it, I will add one more flag in customer session 'two_factor' true/false. And I can validate it. If you have any idea from where Magento checks customer session is valid or not ?