Stored in the session under a reserved key (NOT the signed-in key), so a
route guarded by requireAuth() stays closed during the pending state.
The principal is held here — not in the signed-in record — so a password
alone does not produce a signed-in session for a user who has enrolled.
A sign-in that is awaiting its second factor.
Stored in the session under a reserved key (NOT the signed-in key), so a route guarded by
requireAuth()stays closed during the pending state. The principal is held here — not in the signed-in record — so a password alone does not produce a signed-in session for a user who has enrolled.Since
0.8.0