Authentication · Verified identity
MFA, passkeys and step-up authentication
Separate initial login assurance from extra checks for sensitive actions.
Understand the concept
Multiple factors combine different evidence categories; two passwords are not independent factors. SMS, TOTP, push and passkeys have different threat and usability properties. WebAuthn uses public-key credentials and origin binding, but device, synchronisation and recovery decisions still matter.
Step-up requires stronger or more recent authentication for sensitive actions, such as changing a payment account. Do not trust an eternal client-supplied mfa=true value. Validate provider assurance information and authentication recency according to policy.
Recovery codes, device loss, factor reset and support procedures can undermine strong login if poorly designed. Use appropriate identity libraries or providers rather than implementing WebAuthn primitives manually. Higher authentication assurance still does not replace resource authorisation, and this lesson explains boundaries rather than deploying a factor system.
When designing sensitive administration and account recovery.
Treating a client-supplied mfa=true as sufficient assurance.
One topic. Three levels of depth.
Password + TOTP → distinct evidence categoriesAssess the factor model together with recovery.
This page does not send requests to external servers. Messages are readable HTTP/1.1 illustrations, not HTTP/2 or HTTP/3 wire dumps. example.test is reserved for examples. Run commands and JavaScript only in your own test environment; never publish real tokens or cookies.
Try it yourself first.
May an administrator create a critical key using an old session?
Show the solution and explanation
Require policy-specific recency/assurance, then authorise the action.The role alone may not suffice; use the sensitive-action policy.