Require stronger or more recent authentication for a sensitive action.
A resource server can reject a token whose authentication context is too weak or too old, then tell the client what stronger authentication is required before retrying.
Why this lesson?
A user can browse account information after ordinary sign-in, but a high-value payment requires phishing-resistant and recent authentication.
Learning goal and prerequisites
Attempt a sensitive action
The client has a valid access token, but the user originally authenticated with a lower-assurance method. The application programming interface (API) decides that this sensitive action requires stronger or more recent authentication before it can continue.
Inspect request, response, and claims
Try a failure scenario
↳ Change a condition
Read the detailed explanation
Why it exists, how it works, and where it fits
Not every action in an application carries the same risk. Reading a public profile may need only a normal signed-in session, while changing a payment method or viewing sensitive records may require stronger evidence that the same user is still present. Step-up authentication adds that stronger check only when the risk requires it.
The application first evaluates the requested action and the strength or freshness of the existing authentication. If the current session does not meet the policy, the application sends the user through an additional authentication step. That may require a stronger method, a recent sign-in, or another factor.
After the stronger authentication succeeds, the application records enough information to know that the required assurance level was met. The protected action can then continue. The elevated state should have a clear lifetime and should not silently become a permanent upgrade for every future action.
Step-up authentication is useful because it avoids forcing the strongest possible ceremony on every low-risk interaction. It also does not replace authorization. Even a strongly authenticated user must still have permission to perform the sensitive action on the specific resource.
Investigation
Inspect the traffic, select a diagnosis in the checkpoint, then reveal the repair.
Check your understanding
Pass the lesson quiz
Answer every question correctly to unlock the next lesson. Retry as often as you need.