This lesson's interactive features are locked, please to keep using them

Reauthentication

Not all actions deserve the same level of trust. Viewing your profile? Low risk. Changing your password? High risk.

Reauthentication asks a logged-in user for fresh proof of identity again before they perform a particularly sensitive action. Step-up authentication goes further by raising the session's assurance level, like requiring an additional or stronger factor.

Someone with a stolen session cookie may be able to access the account, but they should not be able to change its email address without also knowing the current password.

When to Reauthenticate

Good candidates for reauth/step-up auth include:

Changing passwords, email, or MFA settings
Transferring money or updating payment methods
Resetting MFA or generating recovery codes
Responding to unusual device or location signals

Every reauthentication prompt adds user friction. Ask too often, and users will hate your app. Ask too little, and attackers with stolen sessions can cause damage.

Assignment

Bearly Secure lets a logged-in user change their email address from the account page. Right now, the reauthentication check doesn't verify the password. Fix reauthentication before changing a user's email address.

In src/routes/account.ts, import the provided verifyPassword function from ../auth/passwords.ts.
In the POST /account/email handler, the app currently checks only whether a password was submitted. Update this check:
1. Use verifyPassword to check the submitted current password against the current user's stored password hash before checking email availability.
2. If the password is missing or wrong, return 403 and show the account page with the following message: "Re-enter your current password to change your email."
  
  Use the same message for both cases, and stop handling the request.
3. If the password is correct, continue with the existing logic.
Start the app.

With Bearly Secure still running, run and submit the CLI tests from the project root.