reauthenticating

Reauthenticating, or reauthentication, is the process of requiring a user to prove their identity again in order to access a resource or perform a sensitive action, even if the user is already authenticated in the current session. It is typically triggered when attempting high-risk operations, after a period of inactivity, or when access to privileged data or controls is requested. The goal is to reduce the risk of unauthorized actions due to session hijacking, stolen devices, or credential compromise by ensuring that the current user still has the right to proceed.

Common methods include re-entering a password, entering a one-time code from an authenticator app or SMS, biometric verification, or security keys (FIDO2). Some systems use risk-based reauth, which asks for extra verification only if the context appears unusual, such as a new device or unusual location.

Reauthentication is not the same as initial login, but rather a separate verification step that may grant elevated privileges or access to restricted features. In many architectures, it is implemented as a second authentication factor or via tokens with shorter lifetimes and higher privileges.

Security and UX considerations: Reauth increases protection but can hinder usability. Designers balance friction and safety; privacy concerns include collecting biometric data. Best practices include clearly communicating why reauth is required, using accessible methods, and handling failures securely.

In practice, reauthentication is common in web services, enterprise systems, and mobile apps; it is supported by authentication frameworks and standards such as OAuth 2.0, OpenID Connect, and SAML in terms of reauthentication prompts and policy.