Beyond Client-Side Theatre: Building Real MFA with Encrypted Scoped Sessions

This post exposes the false security of client-side 2FA validation, where users can bypass authentication entirely by calling protected endpoints directly. By comparing a vulnerable Redis-based OTP system with a proper HashiCorp Vault-backed implementation using encrypted scoped sessions, it demonstrates why server-side enforcement is non-negotiable. For backend engineers, it's a practical lesson in how architectural decisions trump convenience and why real security requires binding authentication challenges to specific actions.