reauthentication

Reauthentication is the process of proving a user's identity again to access a resource or perform a specific action, typically after a session has expired, after a long period of inactivity, or when a task requires higher assurance. It is distinct from the initial login, which establishes a user’s primary session; reauthentication re-verifies identity to authorize a sensitive operation or access to protected data.

Purpose: Reauthentication reduces the risk of unauthorized actions due to session hijacking, stale credentials, or compromised devices. It supports privilege separation, compliance requirements, and step-up authentication, ensuring that access controls are reaffirmed when needed.

Methods: Common methods include prompting for credentials again, biometric verification, one-time codes, push approvals, or device-based checks. In many systems, reauthentication is used to obtain fresh tokens or to trigger a more robust authentication flow (step-up) before granting access to sensitive resources.

Implementation patterns: In web and mobile apps, reauthentication often appears as a separate prompt or a forced login before a high-risk operation. Enterprise systems may require reauthentication for administrative actions or after a credential timeout, often integrated with single sign-on and multi-factor authentication.

Security and usability: Reauthentication balances security and user experience. Poorly designed prompts can cause fatigue or phishing risk; robust implementations employ clear messaging, phishing-resistant methods, proper session timeouts, auditing, and rate limiting.

Examples and contexts: Reauthentication is used in banking apps for transfers, cloud consoles before changing billing plans, and operating systems before accessing encrypted settings. It is also common in identity and access management to trigger step-up authentication when risk is elevated.

See also: authentication, session management, multi-factor authentication, step-up authentication, re-login.