Intermediate LevelAuthentication & Authorization
What is Step-Up Authentication and how do you require re-authentication for high-risk actions?
❓ Interview Prompt: Explain Step-Up Auth triggers, max_age claims, re-prompting 2FA for sensitive actions, and session escalation.
Even if a user has an active valid session, executing high-risk sensitive operations (e.g. changing account email, transferring $10,000, viewing API keys) demands additional security validation. Step-Up Authentication handles this.
Implementation Patterns:
1
Authentication Context Class Reference ('acr') / Auth Time ('auth_time'): The API checks how recently the user verified their password/MFA.
2
Re-Authentication Challenge: If 'auth_time' is older than 5 minutes, the API responds with a '401 Step-Up Required' challenge.
3
Escalation: User re-enters password or scans 2FA TOTP code to complete the sensitive action.
Code Implementation Example
typescript
function requireStepUpAuth(maxAuthAgeSeconds: number = 300) {
return (req: Request, res: Response, next: NextFunction) => {
const authTime = req.user?.auth_time; // Unix timestamp of last MFA prompt
const now = Math.floor(Date.now() / 1000);
if (!authTime || (now - authTime) > maxAuthAgeSeconds) {
return res.status(403).json({
error: 'Step-Up Authentication Required',
code: 'STEP_UP_REQUIRED',
max_age: maxAuthAgeSeconds
});
}
next();
};
}💡Express middleware enforcing Step-Up authentication for sensitive endpoints.
🎯 Interview Key Takeaway
Step-Up Authentication re-prompts users for password or 2FA when attempting high-risk actions during an active session.
#Step-Up Auth#Security#MFA#High Risk#Intermediate
Back to all Authentication & Authorization Questions→