Ask again before changing how someone logs in

How to do it

Accept a fresh proof from the last 5 minutes only. A session that skipped the second factor on a remembered device asks for it here. Send a notice to the old email address with a link to undo the change, as tell people about every change to their sign-in says. Confirm a new address with a link before it can receive resets, as keep the old email until the new one is confirmed says. People who sign in through single sign-on go back to their provider instead, as ask the provider for a fresh sign-in before sensitive changes says. This keeps a stolen session from becoming a stolen account.

Examples

JavaScript example

const RECENT_PROOF_MS = 5 * 60 * 1000;
app.post('/account/email', requireLogin, (req, res, next) =>
  Date.now() - req.session.provedAt < RECENT_PROOF_MS ? next() : res.status(401).json({ error: 'confirm_password' }));

Python example

RECENT_PROOF_SECONDS = 5 * 60

@app.post("/account/email")
def change_email():
    if time.time() - session["proved_at"] > RECENT_PROOF_SECONDS:
        abort(401)
    start_email_change(g.user, request.form["email"])

How to check

With a logged-in test session older than 5 minutes, change the email without the password. The server refuses with 401 or 403. With the password, the change waits for the new address to confirm, and the old address gets a notice.

Sources

• OWASP Authentication Cheat Sheet
• NIST SP 800-63B-4 on reauthentication

Related rules

• WEB-169 Point password managers to your account pages in Website
• ACC-16 Never remove the last way to sign in in Accounts and identity
• ACC-26 Let a remembered device skip only the second factor in Accounts and identity
• ACC-22 Tell people about every change to their sign-in in Accounts and identity
• ACC-53 Keep the old email until the new one is confirmed in Accounts and identity
• ACC-64 Ask the provider for a fresh sign-in before sensitive changes in Accounts and identity
• ACC-66 Notice when a session cookie moves to another device in Accounts and identity
• ACC-45 Transfer ownership only when the new owner accepts in Accounts and identity