Merge pull request #7 from wojt-eu/master

Respond with 401 for request non-HTML requests

lib/two_factor_authentication/controllers/helpers.rb

@@ -10,17 +10,24 @@ module TwoFactorAuthentication
       private
 
       def handle_two_factor_authentication
-        if not request.format.nil? and request.format.html? and not devise_controller?
+        unless devise_controller?
           Devise.mappings.keys.flatten.any? do |scope|
             if signed_in?(scope) and warden.session(scope)[:need_two_factor_authentication]
-              session["#{scope}_return_tor"] = request.path if request.get?
+              handle_failed_second_factor(scope)
-              redirect_to two_factor_authentication_path_for(scope)
-              return
             end
           end
         end
       end
 
+      def handle_failed_second_factor(scope)
+        if request.format.present? and request.format.html?
+          session["#{scope}_return_tor"] = request.path if request.get?
+          redirect_to two_factor_authentication_path_for(scope)
+        else
+          render nothing: true, status: :unauthorized
+        end
+      end
+
       def two_factor_authentication_path_for(resource_or_scope = nil)
         scope = Devise::Mapping.find_scope!(resource_or_scope)
         change_path = "#{scope}_two_factor_authentication_path"