StartupAPI/users — Issue #101: Multiple levels of log in
Author: sergeychernyshev
Created: 2012-01-02 03:51:34+00:00
State: open
Labels: Login flow, Security

Allow for different levels of risk for different areas of the site.

When user accesses the are of the site that requires additional, more restricted, login (e.g. to be logged in within current browser session or within last 15 minutes or maybe even limit to some authentication methods) user is required to enter his credentials (or authenticate using a federated login) again.

Token expiration should be handled separately for each method.

This is particularly important for logins into admin areas of the site or user settings pages and other pages with sensitive information.