Implementing Multi-Step Authentication with Separate Brute-Force Protections

Hello,

Our application has a complex authentication process. When a user enters their email and password, we first verify the email by calling a URL to check if it exists in the database. If the email doesn’t exist, the authentication process stops there, and the password isn’t checked. If the email exists, we proceed to the second step, where the application calls a different URL to verify both the email and password.

To manage this flow, I decided to use two separate login pages, each with its own brute-force attack prevention. I’ve successfully implemented the second login page (with two parameters), but I’m currently stuck on the first login page, as it only requires a single parameter.

First step :

any help would be appreciated

Thank you.