While we all see this as the glaring pain point, it is only because we are conditioned to a current way of logging in. Also this is the point of the token store

While we all see this as the glaring pain point, it is only because we are conditioned to a current way of logging in. Also this is the point of the token stored in cookie storage, the practice used by any large, average user focused company (Facebook/Twitter/Google services). The tokens and session keep them logged in, they hardly ever log in again. If you are a power user that uses a 2 Factor auth, you have already decided you do not mind a "non traditional" way of accessing a service. As an example, logging into AWS takes an extremely long time: 1. pull out a separate device 2. open an app 3. finally enter a set of number (god forbid you do it as it expires). This is far slower than simply opening a new tab / switching to the already open tab or application of a mail client and clicking on a link. This solution only becomes an issue for power users when they personally decide against storing non tracking cookies and allowing sessions. I would also suggest 2 improvements: 1. JWT such that it is not stored in the database 2. If the front end application detects that the token is expired, either refresh the token or begin triggering the email confirmation process EDIT: I do not think this is the best solution, but it could be viable