Multi-factor authentication: The second factor can be skipped

Simply remove the second factor part from mfaWhenWrongCodeThenRedirects and the test fails:

@Test
void mfaWhenSecondFactorSkippedThenRedirects() throws Exception {
	// @formatter:off
	MvcResult result = this.mockMvc.perform(formLogin()
					.user("user@example.com")
					.password("password"))
			.andExpect(redirectedUrl("/second-factor"))
			.andReturn();

	HttpSession session = result.getRequest().getSession();

	// skip the second factor

	this.mockMvc.perform(post("/third-factor")
					.session((MockHttpSession) session)
					.param("answer", "smith")
					.with(csrf()))
			.andExpect(redirectedUrl("/login?error"));
	// @formatter:on
}

Test output:

Redirected URL expected:</login?error> but was:</>
Expected :/login?error
Actual   :/

Start by locating the test containing mfaWhenWrongCodeThenRedirects and mfaWhenSecondFactorSkippedThenRedirects, then run the latter to reproduce the failure. Trace the /third-factor request after formLogin() redirects to /second-factor. Done means the skipped second-factor submission redirects to /login?error rather than /.