Oh I see... I'm still studying the case, but here is an idea:

Instead of having the client access directly the /login, you can put a layer between them. The client access your layer, that forwards the request to the /login, receives the response but only sends it after the 2FA. Does it work for you?

Also, idk if you have checked it out already, but this link might help: 

There is an easy way to do it on Notepad++

  • Open the file with the classes on Notepad++
  • Open the Find and Replace menu (with Ctrl+H or selecting it on the tools bar)
  • Type this on the Find text box: (?s)(?=<Storage)(.+?)(?=</Storage)
  • On the "Search mode" box, you will want to select "Regular expression"
  • Then you can click on Find Next to see if it's selecting everything you want, or, if you're confindent, go straight to the "Replace All" button!

PS.: you might have to use the replace tool to replace the </Storage> part that's left, but it's pretty much the same steps.

PPS.: yes you can leave the Replace text box empty!

Here's the explanation for the expression on a similar situation: https://community.notepad-plus-plus.org/topic/21308/how-to-find-and-sele...

You will wanna follow this steps for what i think it's the easiest and securest way for that:

  • Export everything in a project to an XML
  • Open the file in a notepad or anything similar
  • Open the "Find and Replace" menu - on Windows you use Ctrl+H for that
  • On "Find" you type the current name and on "Replace" the new one, for each class
  • Import again this new document and delete the remaining classes with the old names