@Action("VALIDATE_2FA")
@RequestMapping(value = "/validate", method = RequestMethod.POST)
public ResponseEntity<JSONObject> validateCode(HttpServletRequest request, String userId, String code,
        HttpServletResponse response) throws IOException, TokenIssuerException {

    JSONObject jsonObject = new JSONObject();

    if (code != null) {

        ICode cacheCode = tokenCache.getCode(code, null);

        IClientInfo clientInfo = clientAuthCore.getClient(request, response, true);

        boolean checkClientId = checkClientID(clientInfo, cacheCode);
        if (checkClientId) {

            String seshUser = cacheCode.getSessionInfo().getUserId().trim();

            if (userId != null) {
                // Validate UserID if equals like in cache
                boolean validUser = validateUser(userId, cacheCode);
                if (validUser) {
                    jsonObject.put("code", true);
                    tokenCache.revokeCode(cacheCode);
                    return new ResponseEntity<>(jsonObject, HttpStatus.OK);
                } else {
                    LOG.trace("Validation not passed");
                    jsonObject.put("code", false);
                    return new ResponseEntity<>(jsonObject, HttpStatus.BAD_REQUEST);
                }

            } else {
                jsonObject.put("userID", seshUser);
                tokenCache.revokeCode(cacheCode);
                return new ResponseEntity<>(jsonObject, HttpStatus.OK);
            }
        } else {
            LOG.trace("Invalid Client provided");
            return new ResponseEntity<>(jsonObject, HttpStatus.BAD_REQUEST);
        }
    } else {
        LOG.trace("Invalid parameters");
        return new ResponseEntity<>(jsonObject, HttpStatus.BAD_REQUEST);
    }

}