In my application I want a page to be accessible to the user only after s/he has entered the password again to prevent someone else opening that page in case the user has left a logged-in device open. The application uses JWT tokens for authentication.

How should I implement a re-verification of the password and preserve that until the task on the next page is complete?


The easiest way is to perform both the task in question and the authentication in one go. Let the user fill out any forms and enter the password at the same page. When the user submit, you check that both the JWT and the password are correct server side, and if so execute the task.

This works well for tasks that don't require a lot of user input, like changing your email. For something bigger, like giving access to a full admin area, you need something else.

Lets look at the admin area as an example. One solution is to have a separate login endpoint for the admin area, and after authenticating the user at that endpoint you just add a flag to the JWT payload, e.g. isLoggedInAsAdmin: true. If you want to have the logg in for the admin area expire quicker than the regular logg in you can just use a separate JWT instead.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.