Multi-factor authentication: The second factor can be skipped

[SentretC]

Simply remove the second factor part from mfaWhenWrongCodeThenRedirects and the test fails:

@Test
void mfaWhenSecondFactorSkippedThenRedirects() throws Exception {
    // @formatter:off
    MvcResult result = this.mockMvc.perform(formLogin()
                    .user("user@example.com")
                    .password("password"))
            .andExpect(redirectedUrl("/second-factor"))
            .andReturn();

    HttpSession session = result.getRequest().getSession();

    // skip the second factor

    this.mockMvc.perform(post("/third-factor")
                    .session((MockHttpSession) session)
                    .param("answer", "smith")
                    .with(csrf()))
            .andExpect(redirectedUrl("/login?error"));
    // @formatter:on
}

Test output:

Redirected URL expected:</login?error> but was:</>
Expected :/login?error
Actual   :/