Step-up authentication
Asking for fresh, stronger proof right before a risky action, even though the person is already logged in.
See it
What it is
Step-up authentication asks for stronger or fresher proof at the moment someone tries a sensitive action. A normal session may be enough to read a dashboard, while changing payout details requires a recent WebAuthn assertion or MFA check. The session stays the same person, but its assurance level rises for a short window.
Reach for it before actions that are expensive or hard to reverse: adding an API key, exporting customer data, changing a password, inviting an owner, or disabling MFA. GitHub ships its version as sudo mode, a second prompt that guards security settings for a short window after you answer it. It protects against an unattended laptop and against a stolen long-lived session without forcing every user through the strongest factor on every page.
The gotcha is treating a recent page load as fresh authentication. Record when and how the proof happened, enforce the requirement on the server, and bind the approval to the intended action. A five-minute step-up window for viewing settings should not silently authorize a different tab to transfer money.
Ask AI for it
Add step-up authentication before changing email, disabling MFA, creating an API key, and exporting customer data. Start a WebAuthn challenge with navigator.credentials.get and userVerification set to 'required', verify the challenge, origin, RP ID hash, signature, and user-verified flag on the server, then store step_up_at, step_up_method, approved_action, target_id, and a single-use approval nonce in the server-side session. Each protected endpoint must require proof from the last five minutes whose action and target match, then consume the nonce so approval cannot be replayed for another operation. Return a structured step_up_required error to the UI, resume the original action after success, and write audit events for the challenge and the completed action.