Ask again before changing how someone logs in

How to do it

Accept a fresh proof from the last 5 minutes only. Send a notice to the old email address with a link to undo the change. Confirm a new email address with a link before it can log in or receive resets. This keeps a stolen session from becoming a stolen account.

Example

const RECENT_PROOF_MS = 5 * 60 * 1000;
app.post('/account/email', requireLogin, (req, res, next) =>
  Date.now() - req.session.provedAt < RECENT_PROOF_MS ? next() : res.status(401).json({ error: 'confirm_password' }));

RECENT_PROOF_SECONDS = 5 * 60

@app.post("/account/email")
def change_email():
    if time.time() - session["proved_at"] > RECENT_PROOF_SECONDS:
        abort(401)
    start_email_change(g.user, request.form["email"])

How to check

With a logged-in test session older than 5 minutes, change the email without the password. The server refuses with 401 or 403. With the password, the change waits for the new address to confirm, and the old address gets a notice.