# Ask a user to re-verify password before proceeding with action **URL:** \ **Category:** Get Help\ **Created:** [October 20, 2021, 5:59pm UTC](https://community.auth0.com/t/ask-a-user-to-re-verify-password-before-proceeding-with-action/71677 "2021-10-20T17:59:20Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![matthew.sanders.topt](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/matthew.sanders.topt/32/12776_2.png) [@matthew.sanders.topt](https://community.auth0.com/u/matthew.sanders.topt)\ **Post date:** [October 20, 2021, 5:59pm UTC](https://community.auth0.com/t/ask-a-user-to-re-verify-password-before-proceeding-with-action/71677/1 "2021-10-20T17:59:20Z")
Hey everyone Is there a way to require a user to verify their password for email / password connections? Stripe has a good example of this. If you attempt to make a destructive action like editing a product, deleting a customer etc, you have to confirm your password, essentially log in again, before doing so. Is there a way to achieve this with Auth0? If a user is already logged in and we push them to the universal login, they’ll be immediately redirected back to us because they never logged out. Cheers ---
**Author:** ![rueben.tiow](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/rueben.tiow/32/11646_2.png) [@rueben.tiow](https://community.auth0.com/u/rueben.tiow)\ **Post date:** [October 20, 2021, 10:39pm UTC](https://community.auth0.com/t/ask-a-user-to-re-verify-password-before-proceeding-with-action/71677/3 "2021-10-20T22:39:56Z")
Hi @matthew.sanders.topt, Thanks for reaching out to the Auth0 Community! It sounds to me that you are looking to perform [Step-Up Authentication](https://auth0.com/docs/login/mfa/step-up-authentication) for your application. Step-Up Authentication is a way of asking the user to authenticate again to gain access to specific resources and access control. Then after authenticating they can proceed with these actions. You may find our documentation on [Step-Up Authentication for webapps](https://auth0.com/docs/login/mfa/step-up-authentication/configure-step-up-authentication-for-web-apps) useful. Please let me know if you have any further questions. Thank you! ---
**Author:** ![matthew.sanders.topt](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/matthew.sanders.topt/32/12776_2.png) [@matthew.sanders.topt](https://community.auth0.com/u/matthew.sanders.topt)\ **Post date:** [October 20, 2021, 10:47pm UTC](https://community.auth0.com/t/ask-a-user-to-re-verify-password-before-proceeding-with-action/71677/4 "2021-10-20T22:47:31Z")
Hmmm almost, but not quite. Thanks for the resource though, I didn’t know this was a feature. From my understanding, Step-Up Authentication requires a separate authentication method ( e.g. SMS, rotating code, etc ). We really just want the user to authenticate again to confirm they want the action to proceed, especially when it’s a potentially destructive action. ---
**Author:** ![Ale](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/ale/32/50860_2.png) [@Ale](https://community.auth0.com/u/Ale)\ **Post date:** [October 20, 2021, 10:55pm UTC](https://community.auth0.com/t/ask-a-user-to-re-verify-password-before-proceeding-with-action/71677/5 "2021-10-20T22:55:42Z")
I just wanted to leave this here: [https://auth0.com/docs/login/max-age-reauthentication](https://auth0.com/docs/login/max-age-reauthentication) ---
**Author:** ![rueben.tiow](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/rueben.tiow/32/11646_2.png) [@rueben.tiow](https://community.auth0.com/u/rueben.tiow)\ **Post date:** [October 20, 2021, 11:04pm UTC](https://community.auth0.com/t/ask-a-user-to-re-verify-password-before-proceeding-with-action/71677/6 "2021-10-20T23:04:14Z")
Thanks for sharing that documentation @Ale! Just to reiterate, you can force reauthentication again by passing the `prompt=login` parameter to the authentication request. Please let me know how this works for you. Thank you. ---
**Author:** ![matthew.sanders.topt](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/matthew.sanders.topt/32/12776_2.png) [@matthew.sanders.topt](https://community.auth0.com/u/matthew.sanders.topt)\ **Post date:** [October 20, 2021, 11:06pm UTC](https://community.auth0.com/t/ask-a-user-to-re-verify-password-before-proceeding-with-action/71677/7 "2021-10-20T23:06:22Z")
Ah perfect, I just stumbled over this also. I think we can make something work with this. It’s a little unfortunate that once the user lands on this page they can actually enter any username / password and also still have the option of creating an account. Maybe there are ways around this using the new universal login experience and hiding some options? Otherwise I guess we can always verify the users are the same when they return, it’s just a little bit of a funky user experience. ---
**Author:** ![rueben.tiow](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/rueben.tiow/32/11646_2.png) [@rueben.tiow](https://community.auth0.com/u/rueben.tiow)\ **Post date:** [October 20, 2021, 11:17pm UTC](https://community.auth0.com/t/ask-a-user-to-re-verify-password-before-proceeding-with-action/71677/8 "2021-10-20T23:17:42Z")
Hi @matthew.sanders.topt, That sounds great! That’s a great point, that the user may see the Sign Up option as well. If needed, you can remove that [Lock Configuration Option](https://auth0.com/docs/libraries/lock/lock-configuration#database) by setting the `allowSignUp: false` in your Auth0Lock in the Universal Login. ---
**Author:** ![system](https://global.discourse-cdn.com/auth0/original/3X/b/5/b560f266932fcce5d57f09a6595bd50518cae3f3.jpeg) [@system](https://community.auth0.com/u/system)\ **Post date:** [November 4, 2021, 11:18pm UTC](https://community.auth0.com/t/ask-a-user-to-re-verify-password-before-proceeding-with-action/71677/9 "2021-11-04T23:18:19Z")
This topic was automatically closed 15 days after the last reply. New replies are no longer allowed.