Re-authentication with Google Plus

Question

Is there an equivalent Google+ API method or option for the use-case described below?

https://developers.facebook.com/docs/facebook-login/reauthentication/

Specifically, when our users significantly modify their account with us, we want to require them to re-enter their password without first logging them out of our app or Google.

Thanks!

Answer 1

Short answer: no.

Longer answer: There is no official reauth method in the Google OAuth 2.0 setup. In part this is because it trains users to reenter their password if a reasonable looking prompt appears, which in general makes phishing attacks a bit easier to do. If you're concerned you should be able to push the user through the sign-in flow again - there's some good suspicious activity checking at the Google level which will prompt them for password or other factors if required.

If you do need something more, then most of the time what you're trying to test with this is actually establish that the user you expect is present - e.g. that its really them using their browser or similar. This isn't foolproof, as people use password managers - it's just an extra signal that is is likely the user you expect using the system. You could roll your own in a couple of different ways - e.g. you could send them an email or a text message with a code to confirm, or if you have a mobile application and they had it installed, you could prompt them to confirm on there.