Java Web App with 2FA

I’m building a Java-based web application and the very first module I need completed is secure user authentication that relies on two-factor verification rather than the usual single-password flow. The goal is simple but critical: a visitor must be able to register, log in, and re-authenticate using a second factor (TOTP, SMS, or a similar mechanism we agree on) before gaining access to protected routes.

The stack is Java on the back-end; I’m comfortable if you lean on frameworks such as Spring Boot and Spring Security, but I’m equally open to lighter solutions provided you can document every step clearly. What matters most is clean, maintainable code and a frictionless developer setup so the rest of the product team can extend your work later.

Deliverables I need from you:
• Source code and build file(s) ready to run locally and deploy to a standard Linux server.
• A concise README covering environment variables, build commands, and how to switch 2FA providers.
• Endpoint or page flow tests proving a successful and a failed 2FA attempt.

Acceptance criteria: a user who passes username/password but skips or fails the second factor must be denied access; passing both factors must yield a session or token that protects downstream API calls.

If that’s straightforward for you, tell me how you plan to implement the 2FA step, which libraries you prefer, and an estimated timeline for handing over the tested module.