Security
Step-up authentication: asking for more proof only when it matters
How step-up authentication works with OpenID Connect acr and max_age and the RFC 9470 challenge, and which actions deserve a fresh proof of identity.
The short answer
Step-up authentication requires a user who is already signed in to prove their identity again, or with a stronger method, before a sensitive action. In OpenID Connect the client requests it with max_age (how recently the user must have authenticated) or acr_values (how strongly), and RFC 9470 defines how an API can reply that the presented token is insufficient so the client knows to step up.
Sources last reviewed .
Which actions deserve it
- Changing the password, email or MFA methods.
- Viewing or exporting large amounts of sensitive data.
- Administrative actions: changing tenant policy, inviting administrators, creating API credentials.
- Financial or irreversible operations.
The mechanics
The ID token's auth_time and acr claims record when and how the user authenticated (OpenID Connect Core). Before a sensitive action, the application checks them; if they are too old or too weak, it sends the user back to the provider with max_age=0 (or prompt=login) and the required acr_values. RFC 9470 lets a resource server signal the same requirement with a WWW-Authenticate error of insufficient_user_authentication.
Pitfall
A plain authorization request is not a step-up. If the provider has a live session it will return immediately without re-authenticating. You must request it explicitly and verify auth_time in the result.
In Authreads
How this applies to Authreads
The Authreads authorization endpoint supports prompt=login, max_age and hierarchical acr_values minimums (urn:authreads:acr:mfa, urn:authreads:acr:phr), and tokens carry the achieved acr and amr. Essential acr requests through the claims parameter are not supported.
Authreads is a multi-tenant identity platform in beta. Capability status is maintained on /roadmap as Available, In progress or Planned.
Keep reading
Building on any of this?
Tell us what you're putting together. We'll tell you plainly whether Authreads fits it.