I am working on a module that implements two factor authentication.
I have created an observer to the event
customer_login , so just after when the customer has logged in, they are directed to a custom page for the two factor authentication, if authentication is successful he is directed to the home page.
But the problem is when the customer is in the custom page, he could change the URL and get to the home page(ie. without completing the two factor authentication process). How do I restrict the customer from navigating to other pages without completing the two factor authentication?