← All practicals

Step up before a sensitive action

Enrol TOTP, then re-prove it to rotate a client secret — session step-up (AAL).

1. 1

   Enrol a TOTP authenticator on your account (finish P4 if you haven’t).

   Step-up can only ask for a factor you actually have — with TOTP enrolled, sensitive actions demand a FRESH proof of it, even inside a live session.

2. 2

   Try to remove a passkey on your account page — it’s blocked with step_up_required.

   Removing a credential is sensitive: stripping the victim’s factors is the second half of a stolen-cookie takeover, so the Lab refuses it (403) until you re-authenticate. (If you have registered your own app under P7, rotating its client secret is gated by the exact same check.)

3. 3

   Enter a current TOTP code when the step-up prompt appears, then remove it again — it succeeds.

   A successful step-up stamps stepped_up_at on the session; the delete now passes because the proof is fresh (within a 5-minute window) — NIST AAL step-up in miniature.