Requiring Re-authentication
Trying to figure out how to force an already signed-in user to re-enter their password before letting them access a sensitive area of your service? This page is for you.
Your service isn't supposed to have access to the user's credentials, so adding a password prompt on your own website is out of the question. The solution is to have the ID service re-authenticate the user before letting them perform sensitive actions.
Determining authentication age
Your service can use the iat claim of the ID token to find when it was issued.
iat: Time at which the JWT was issued. Its value is a JSON number representing the number of seconds from 1970-01-01T0:0:0Z as measured in UTC until the date/time.
— ID Token
Re-authentication
When your web site determines that a user should re-authenticate, show them a notification about it before redirecting them to authentication, so they aren't surprised by it.
Use the same authentication URL as during normal authentication, but with some differences in parameters, to force the user to authenticate with the same account.
Suggested parameters
| Request parameter | Value | Effect |
|---|---|---|
login_hint | Username or email address, automatically inserted into the login name field. | User doesn't have to re-enter the username unnecessarily. |
prompt | login | Forces the user to re-authenticate regardless of any existing session or remember-me cookie. |
claims | {"userinfo":{"sub":{"value":"123456789abcdefgh"}}} | The ID server rejects authentication unless completed with the user account matching the given user ID (sub). |
state | Information of your choice, passed to the authentication callback. | You can direct the user to the correct page by reading the state value after successful re-authentication. |
After a successful re-authentication, your service should still verify that the user account is correct, or alternatively just service the other account.