relogin

Relogin, or re-authentication, is the process of verifying a user's identity again to regain access after a prior authentication has expired or a security policy requires it. It is used in web applications, mobile apps, desktop software, and operating systems to protect sensitive data and actions.

Relogin is prompted when a session times out, when a user requests access to a high-risk operation, after a password change, or when moving across devices. It may also be required by organizational policy, regulatory compliance, or changes in the user's risk profile.

Mechanisms include interactive prompts where the user re-enters credentials, or multi-factor methods such as one-time codes, biometrics, or push approvals. Some systems support silent reauthentication, exchanging refresh tokens for new access tokens without user input, while still enforcing MFA at defined intervals.

Security considerations: relogin reduces risk of stolen sessions on inactive devices and ensures proof of possession for sensitive actions. However, frequent prompts can hurt usability. Best practices include using TLS for credential and token exchange, protecting refresh tokens, employing contextual or risk-based prompts, and aligning session lifetimes with the sensitivity of operations.

Relation to broader concepts: relogin is a component of session management and is commonly used in single sign-on (SSO) environments and with OAuth/OpenID Connect flows. It is distinct from signing out, though the two may be triggered by the same security policy.

Examples: Online banking often requires reauthentication for transfers; enterprise apps may request reauthentication for administrator actions or when delegating privileged tasks.