reauthenticated

Reauthenticated refers to the act of confirming a user’s identity by presenting credentials again after an initial login. It is distinct from the original authentication and is used to verify continued intent or to authorize high‑risk actions. Reauthentication can be required by security policies, regulatory requirements, or system risk assessments.

The purpose of reauthentication is to reduce the risk of unauthorized actions due to session hijacking, stale credentials, or compromised devices. It helps ensure that the person performing a sensitive operation is indeed the rightful user, particularly after long sessions or when unusual activity is detected.

Typically, when reauthentication is required, the user is prompted to provide credentials again or complete an additional verification step, such as a one-time code, biometric confirmation, or a hardware security key. The system may extend the existing session after successful reauthentication or issue a new, short‑lived token for the sensitive action.

Common triggers include inactivity timeouts, attempts to access restricted features (for example, changing account settings or initiating a transfer), changes to account security (password updates), login from a new device or location, or detected unusual activity.

Reauthentication introduces some friction for users, so many systems balance security with usability by combining reauth with risk‑based checks, allowing trusted devices to bypass repeated prompts, or using step‑up MFA when higher assurance is required.

In the context of web and application security, reauthentication is implemented through session management, prompts in OAuth/OpenID Connect workflows, or policy‑driven step‑up authentication. It is part of broader authentication and access control practices.