This lesson's interactive features are locked, please to keep using them

Reauthentication

Not all actions deserve the same level of trust. Viewing your profile? Low risk. Changing your password? High risk.

Reauthentication asks a logged-in user for fresh proof of identity again before they perform a particularly sensitive action. Step-up authentication goes further by raising the session's assurance level, like requiring an additional or stronger factor.

When to Reauthenticate

Good candidates for reauth/step-up auth are:

Changing passwords, email, or MFA settings
Transferring money or updating payment methods
Resetting MFA or generating recovery codes
Responding to unusual device or location signals

Every reauthentication prompt adds user friction. Ask too often, and users will hate your app. Ask too little, and attackers with stolen sessions can cause damage.

Assignment

Bearly Secure lets a logged-in user change their email address from the account page without re-entering their password.

Fix reauthentication before changing a user's email address.

In web/templates/account.html, add a required currentPassword field to the email-change form.
In internal/account/handler.go, require the submitted current password and verify it with passwords.Verify before checking email availability or changing the email.
Return 403 with the same reauthentication message when the password is missing or wrong.
Start the app.

With Bearly Secure still running, run and submit the CLI tests from the project root.