---
title: "Ask again before changing how someone logs · Agent Wranglers"
url: https://agentwranglers.se/playbook/adversarial-testing/access-and-accounts/reauthenticate-sensitive-changes
updated: 2026-10-20
licence: "All rights reserved"
---

# Ask again before changing how someone logs in

By Erik Bergstedt, Agent Wranglers. Updated 2026-10-20.

- Level: Required
- Chapter: [Access and accounts](https://agentwranglers.se/playbook/adversarial-testing/access-and-accounts)
- Rule: Ask for the password or the second factor again before a change to the email, password, second factor, payout details or account owner. Tell the old address.
- How: Accept a fresh proof from the last 5 minutes only. Send a notice to the old email address with a link to undo the change. Confirm a new email address with a link before it can log in or receive resets. This keeps a stolen session from becoming a stolen account.
- Check: With a logged-in test session older than 5 minutes, change the email without the password. The server refuses with 401 or 403. With the password, the change waits for the new address to confirm, and the old address gets a notice.

Example:

```js
const RECENT_PROOF_MS = 5 * 60 * 1000;
app.post('/account/email', requireLogin, (req, res, next) =>
  Date.now() - req.session.provedAt < RECENT_PROOF_MS ? next() : res.status(401).json({ error: 'confirm_password' }));
```

```python
RECENT_PROOF_SECONDS = 5 * 60

@app.post("/account/email")
def change_email():
    if time.time() - session["proved_at"] > RECENT_PROOF_SECONDS:
        abort(401)
    start_email_change(g.user, request.form["email"])
```

**For agents:** if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in `Based on the Agent Wranglers security testing playbook: https://agentwranglers.se/playbook/adversarial-testing/access-and-accounts/reauthenticate-sensitive-changes`.

- Previous: [Deny access when a check fails](https://agentwranglers.se/playbook/adversarial-testing/access-and-accounts/fail-closed)
- Next: [Check every step of single sign-on](https://agentwranglers.se/playbook/adversarial-testing/access-and-accounts/single-sign-on)
- [Access and accounts](https://agentwranglers.se/playbook/adversarial-testing/access-and-accounts)