Web Security · Middle · Question 48 of 75

Why should a user be asked for their password again before changing their email or password?

✓Correct answer: So that a hijacked or unattended session can't take over the account permanently
2To refresh the browser cache
3Because the session cookie expires on that page

Explanation

Re-authentication for critical actions limits the damage of session theft, CSRF and XSS.

Further reading

Test yourself

Take the Web Security · Middle quiz: questions and options are shuffled, and you get a review of your mistakes at the end.