diff --git a/src/Controller/Traits/LoginTrait.php b/src/Controller/Traits/LoginTrait.php
index 28c30d588..471bc4b39 100644
--- a/src/Controller/Traits/LoginTrait.php
+++ b/src/Controller/Traits/LoginTrait.php
@@ -218,20 +218,15 @@ public function verify()
             return $this->redirect(Configure::read('Auth.loginAction'));
         }
 
-        // storing user's session in the temporary one
-        // until the GA verification is checked
-        $temporarySession = $this->Auth->user();
-        $this->request->getSession()->delete('Auth.User');
+        $temporarySession = $this->request->getSession()->read('temporarySession');
+        if (!is_array($temporarySession) || empty($temporarySession)) {
+            $this->Flash->error(__d('CakeDC/Users', 'Invalid request.'), 'default', [], 'auth');
 
-        if (!empty($temporarySession)) {
-            $this->request->getSession()->write('temporarySession', $temporarySession);
-        }
-
-        if (array_key_exists('secret', $temporarySession)) {
-            $secret = $temporarySession['secret'];
+            return $this->redirect(Configure::read('Auth.loginAction'));
         }
 
-        $secretVerified = Hash::get((array)$temporarySession, 'secret_verified');
+        $secret = Hash::get($temporarySession, 'secret');
+        $secretVerified = Hash::get($temporarySession, 'secret_verified');
 
         // showing QR-code until shared secret is verified
         if (!$secretVerified) {
@@ -322,14 +317,16 @@ protected function _checkReCaptcha()
     protected function _afterIdentifyUser($user, $socialLogin = false, $googleAuthenticatorLogin = false)
     {
         if (!empty($user)) {
-            $this->Auth->setUser($user);
-
             if ($googleAuthenticatorLogin) {
+                // storing user's session in the temporary one
+                // until the GA verification is checked
+                $this->request->getSession()->write('temporarySession', $user);
                 $url = Configure::read('GoogleAuthenticator.verifyAction');
 
                 return $this->redirect($url);
             }
 
+            $this->Auth->setUser($user);
             $event = $this->dispatchEvent(UsersAuthComponent::EVENT_AFTER_LOGIN, ['user' => $user]);
             if (is_array($event->result)) {
                 return $this->redirect($event->result);
diff --git a/tests/TestCase/Controller/Traits/LoginTraitTest.php b/tests/TestCase/Controller/Traits/LoginTraitTest.php
index 47a3d29c5..81571fc5e 100644
--- a/tests/TestCase/Controller/Traits/LoginTraitTest.php
+++ b/tests/TestCase/Controller/Traits/LoginTraitTest.php
@@ -391,24 +391,43 @@ public function testFailedSocialUserAccount()
     public function testVerifyHappy()
     {
         Configure::write('Users.GoogleAuthenticator.login', true);
-        $this->Trait->Auth = $this->getMockBuilder('Cake\Controller\Component\AuthComponent')
-            ->setMethods(['user', ])
-            ->disableOriginalConstructor()
-            ->getMock();
-        $user = [
-            'id' => 1,
-            'secret_verified' => 1,
-        ];
-        $this->Trait->Auth->expects($this->at(0))
-            ->method('user')
-            ->will($this->returnValue($user));
+
         $this->Trait->request = $this->getMockBuilder('Cake\Network\Request')
-            ->setMethods(['is', 'getData', 'allow'])
+            ->setMethods(['is', 'getData', 'allow', 'getSession'])
             ->getMock();
-        $this->Trait->request->expects($this->at(0))
+        $this->Trait->request->expects($this->once())
             ->method('is')
             ->with('post')
             ->will($this->returnValue(false));
+
+        $this->_mockSession([
+            'temporarySession' => [
+                'id' => 1,
+                'secret_verified' => 1,
+            ]
+        ]);
+        $this->Trait->verify();
+    }
+
+    /**
+     * testVerifyNoUser
+     *
+     */
+    public function testVerifyNoUser()
+    {
+        Configure::write('Users.GoogleAuthenticator.login', true);
+
+        $this->Trait->request = $this->getMockBuilder('Cake\Network\Request')
+            ->setMethods(['is', 'getData', 'allow', 'getSession'])
+            ->getMock();
+        $this->Trait->request->expects($this->never())
+            ->method('is')
+            ->with('post');
+        $this->_mockSession([]);
+        $this->_mockFlash();
+        $this->Trait->Flash->expects($this->once())
+            ->method('error')
+            ->with('Invalid request.');
         $this->Trait->verify();
     }
 
@@ -433,30 +452,26 @@ public function testVerifyNotEnabled()
     public function testVerifyGetShowQR()
     {
         Configure::write('Users.GoogleAuthenticator.login', true);
-        $this->Trait->Auth = $this->getMockBuilder('Cake\Controller\Component\AuthComponent')
-            ->setMethods(['user', ])
-            ->disableOriginalConstructor()
-            ->getMock();
-        $user = [
-            'id' => '00000000-0000-0000-0000-000000000001',
-            'email' => 'email@example.com',
-            'secret_verified' => 0,
-        ];
-        $this->Trait->Auth->expects($this->at(0))
-            ->method('user')
-            ->will($this->returnValue($user));
+
         $this->Trait->GoogleAuthenticator = $this->getMockBuilder(GoogleAuthenticatorComponent::class)
             ->disableOriginalConstructor()
             ->setMethods(['createSecret', 'getQRCodeImageAsDataUri'])
             ->getMock();
 
         $this->Trait->request = $this->getMockBuilder(ServerRequest::class)
-            ->setMethods(['is', 'getData', 'allow'])
+            ->setMethods(['is', 'getData', 'allow', 'getSession'])
             ->getMock();
-        $this->Trait->request->expects($this->at(0))
+        $this->Trait->request->expects($this->once())
             ->method('is')
             ->with('post')
             ->will($this->returnValue(false));
+        $this->_mockSession([
+            'temporarySession' => [
+                'id' => '00000000-0000-0000-0000-000000000001',
+                'email' => 'email@example.com',
+                'secret_verified' => 0,
+            ]
+        ]);
         $this->Trait->GoogleAuthenticator->expects($this->at(0))
             ->method('createSecret')
             ->will($this->returnValue('newSecret'));
@@ -469,4 +484,23 @@ public function testVerifyGetShowQR()
             ->with(['secretDataUri' => 'newDataUriGenerated']);
         $this->Trait->verify();
     }
+
+    /**
+     * Mock session and mock session attributes
+     *
+     * @return void
+     */
+    protected function _mockSession($attributes)
+    {
+        $session = new \Cake\Http\Session();
+
+        foreach ($attributes as $field => $value) {
+            $session->write($field, $value);
+        }
+
+        $this->Trait->request
+            ->expects($this->any())
+            ->method('getSession')
+            ->willReturn($session);
+    }
 }