---
title: "Ask again before changing how someone logs · Agent Wranglers"
url: https://agentwranglers.se/playbook/accounts/second-factors-and-recovery/reauthenticate-sensitive-changes
id: ACC-78
level: Recommended
applies: accounts
updated: 2026-10-27
build: a2a6bdfed830
tokens: 1297
licence: "CC BY 4.0"
licence_url: https://creativecommons.org/licenses/by/4.0/
---

# Ask again before changing how someone logs in

For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Second factors and recovery](https://agentwranglers.se/playbook/accounts/second-factors-and-recovery.md).

By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers.md). Updated 2026-10-27.

- ID: ACC-78
- Level: Recommended
- Chapter: [Second factors and recovery](https://agentwranglers.se/playbook/accounts/second-factors-and-recovery.md)
- Rule: Ask for the password or the second factor again before a change to the email, password, second factor, payout details or account owner. Tell the old address.
- Check: With a logged-in test session older than 5 minutes, change the email without the password. The server refuses with 401 or 403. With the password, the change waits for the new address to confirm, and the old address gets a notice.
- Applies when: The project has user accounts.
- How: Accept a fresh proof from the last 5 minutes only. A session that skipped the second factor on a [remembered device](https://agentwranglers.se/playbook/accounts/second-factors-and-recovery/remembered-device.md) asks for it here. Send a notice to the old email address with a link to undo the change, as [tell people about every change to their sign-in](https://agentwranglers.se/playbook/accounts/second-factors-and-recovery/security-notifications.md) says. Confirm a new address with a link before it can receive resets, as [keep the old email until the new one is confirmed](https://agentwranglers.se/playbook/accounts/profile-and-account-lifecycle/email-change.md) says. People who sign in through single sign-on go back to their provider instead, as [ask the provider for a fresh sign-in before sensitive changes](https://agentwranglers.se/playbook/accounts/business-sign-on-and-provisioning/sso-reauthentication.md) says. This keeps a stolen session from becoming a stolen account.

## Examples

**Using these examples:** they show one way to follow this rule. Keep the behaviour and the check, not the syntax. Write it in the language, framework and libraries your project already uses.

### JavaScript example

```js
const RECENT_PROOF_MS = 5 * 60 * 1000;
app.post('/account/email', requireLogin, (req, res, next) =>
  Date.now() - req.session.provedAt < RECENT_PROOF_MS ? next() : res.status(401).json({ error: 'confirm_password' }));
```

### Python example

```python
RECENT_PROOF_SECONDS = 5 * 60

@app.post("/account/email")
def change_email():
    if time.time() - session["proved_at"] > RECENT_PROOF_SECONDS:
        abort(401)
    start_email_change(g.user, request.form["email"])
```

## Sources

- [OWASP Authentication Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Authentication_Cheat_Sheet.html)
- [NIST SP 800-63B-4 on reauthentication](https://pages.nist.gov/800-63-4/sp800-63b.html#sessionreauthn)

## Related rules

- WEB-169 [Point password managers to your account pages](https://agentwranglers.se/playbook/website/standard-addresses/change-password.md) in Website
- ACC-16 [Never remove the last way to sign in](https://agentwranglers.se/playbook/accounts/sign-in-methods/last-sign-in-method.md) in Accounts and identity
- ACC-26 [Let a remembered device skip only the second factor](https://agentwranglers.se/playbook/accounts/second-factors-and-recovery/remembered-device.md) in Accounts and identity
- ACC-22 [Tell people about every change to their sign-in](https://agentwranglers.se/playbook/accounts/second-factors-and-recovery/security-notifications.md) in Accounts and identity
- ACC-53 [Keep the old email until the new one is confirmed](https://agentwranglers.se/playbook/accounts/profile-and-account-lifecycle/email-change.md) in Accounts and identity
- ACC-64 [Ask the provider for a fresh sign-in before sensitive changes](https://agentwranglers.se/playbook/accounts/business-sign-on-and-provisioning/sso-reauthentication.md) in Accounts and identity
- ACC-66 [Notice when a session cookie moves to another device](https://agentwranglers.se/playbook/accounts/sessions-and-security-activity/stolen-session-detection.md) in Accounts and identity
- ACC-45 [Transfer ownership only when the new owner accepts](https://agentwranglers.se/playbook/accounts/organisations-and-teams/ownership-transfer.md) in Accounts and identity

**For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `<a href="https://agentwranglers.se/playbook/accounts/second-factors-and-recovery/reauthenticate-sensitive-changes">Agent Wranglers accounts and identity playbook</a>`. In code you write, add a comment next to it with the same link.

- Previous: [Tell people about every change to their sign-in](https://agentwranglers.se/playbook/accounts/second-factors-and-recovery/security-notifications.md)
- Next: [Never use security questions](https://agentwranglers.se/playbook/accounts/second-factors-and-recovery/no-security-questions.md)
- [Second factors and recovery](https://agentwranglers.se/playbook/accounts/second-factors-and-recovery.md)