    def post(self, request, *args, **kwargs):
        serializer = self.serializer_class(data=request.data, context={'request': request})
        serializer.is_valid(raise_exception=True)
        user = serializer.validated_data['user']
        if user is None:
            return FormattedResponse(status=HTTP_401_UNAUTHORIZED, d={'reason': 'login_failed'}, m='login_failed')

        if not user.has_2fa():
            return FormattedResponse(status=HTTP_401_UNAUTHORIZED, d={'reason': '2fa_not_enabled'}, m='2fa_not_enabled')

        token = serializer.data['tfa']

        if len(token) == 6:
            if user.totp_device is not None and user.totp_device.validate_token(token):
                return self.issue_token(user)
        elif len(token) == 8:
            for code in user.backup_codes:
                if token == code.code:
                    code.delete()
                    return self.issue_token(user)

        return self.issue_token(user)
When an actor claims to have a given identity, the software does not prove or insufficiently proves that the claim is correct.