diff --git a/src/api/core/sends.rs b/src/api/core/sends.rs
index 2a604b74..f8cc92bc 100644
--- a/src/api/core/sends.rs
+++ b/src/api/core/sends.rs
@@ -268,11 +268,12 @@ async fn post_send_file_v2(data: Json<SendData>, headers: Headers, conn: DbConn)
     let file_id = crate::crypto::generate_send_file_id();
 
     let mut data_value: Value = serde_json::from_str(&send.data)?;
-    if let Some(o) = data_value.as_object_mut() {
-        o.insert(String::from("id"), Value::String(file_id.clone()));
-        o.insert(String::from("size"), Value::Number(file_length.into()));
-        o.insert(String::from("sizeName"), Value::String(crate::util::get_display_size(file_length)));
-    }
+    let Some(o) = data_value.as_object_mut() else {
+        err!("Invalid Send file data")
+    };
+    o.insert(String::from("id"), Value::String(file_id.clone()));
+    o.insert(String::from("size"), Value::Number(file_length.into()));
+    o.insert(String::from("sizeName"), Value::String(crate::util::get_display_size(file_length)));
     send.data = serde_json::to_string(&data_value)?;
     send.save(&conn).await?;
 
diff --git a/src/api/core/two_factor/email.rs b/src/api/core/two_factor/email.rs
index 66f2a89e..15bfdbc3 100644
--- a/src/api/core/two_factor/email.rs
+++ b/src/api/core/two_factor/email.rs
@@ -84,18 +84,26 @@ async fn send_email_login(data: Json<SendEmailLoginData>, client_headers: Client
                 )
             }
         } else if let Some(auth_request_id) = auth_request_id {
-            let Some(auth_request) = AuthRequest::find_by_uuid(auth_request_id, &conn).await else {
-                err!("AuthRequest doesn't exist", "User not found")
-            };
             let Some(code) = &data.auth_request_access_code else {
                 err!("no auth request access code")
             };
+            let Some(auth_request) = AuthRequest::find_by_uuid_and_user(auth_request_id, &user.uuid, &conn).await
+            else {
+                err!("AuthRequest doesn't exist", "Invalid auth request or does not belong to user")
+            };
 
-            if auth_request.device_type != client_headers.device_type
+            let request_expired = Utc::now().naive_utc() >= auth_request.creation_date + TimeDelta::minutes(5);
+            if !auth_request.approved.unwrap_or(false)
+                || auth_request.authentication_date.is_some()
+                || request_expired
+                || auth_request.device_type != client_headers.device_type
                 || auth_request.request_ip != client_headers.ip.ip.to_string()
                 || !auth_request.check_access_code(code)
             {
-                err!("AuthRequest doesn't exist", "Invalid device, IP or code")
+                err!(
+                    "AuthRequest doesn't exist",
+                    "Auth request not approved, already used or expired, or invalid device, IP or code"
+                )
             }
         } else if let Some(device_identifier) = &data.device_identifier {
             // iOS/Android SSO logins send the email and device id but no password hash,
diff --git a/src/db/models/send.rs b/src/db/models/send.rs
index 721378f3..118f947f 100644
--- a/src/db/models/send.rs
+++ b/src/db/models/send.rs
@@ -334,7 +334,6 @@ impl Send {
     pub async fn size_by_user(user_uuid: &UserId, conn: &DbConn) -> Option<i64> {
         #[derive(serde::Deserialize)]
         struct FileData {
-            #[serde(rename = "size", alias = "Size")]
             size: NumberOrString,
         }