谷歌/微软站点密码重提示的术语、所属流程及OIDC/OAuth2关联问询

1. Formal Term for Password Re-prompt #

In web identity and security specifications, the official name for a "password re-prompt" is Password Re-authentication Prompt. If the re-verification step isn't restricted to just passwords (e.g., it could include multi-factor authentication), the broader term Re-authentication Prompt is used. This terminology is consistent across major identity providers and security documentation to describe the request for a user to re-verify their credentials to continue accessing protected resources.

2. Idle/Tab-Dormancy Re-authentication Mechanism (with Non-Editable Email) #

Professional Term #

This specific flow is commonly referred to as Idle Session Timeout Triggered Re-authentication (or more casually, Session Idle Re-authentication). The non-editable email shown during this process is an example of Identity Context Preservation—it anchors the re-authentication to the currently logged-in user, preventing accidental credential entry for the wrong account and making it explicit which identity is being re-verified.

Which Process Does It Fall Under? #

This is a core part of Session Management within an identity system, specifically the Session Security Enforcement subset. The purpose is to mitigate risks from abandoned or stale sessions: after a defined period of inactivity (whether the browser is dormant or the tab is unused), the system requires re-authentication to confirm the user is still the legitimate holder of the session, reducing unauthorized access risks if a device is left unattended.

Is It Part of OIDC or OAuth2? #

Let's break this down:

• OAuth2: No. OAuth2 is an authorization framework focused on granting third-party applications access to resources. It does not define standards for end-user session management or re-authentication workflows.
• OIDC (OpenID Connect): Yes, in part. OIDC is built on OAuth2 and adds an identity layer, including a Session Management (SM) extension that standardizes how clients can manage user sessions—including triggering re-authentication when session validity needs to be confirmed. While OIDC doesn't dictate idle timeout rules (those are usually platform-specific security policies), the core re-authentication flow for session validation aligns with OIDC's session management specs. Google and Microsoft’s implementations use this OIDC foundation and add their own rules for idle thresholds and context display.

内容的提问来源于stack exchange，提问作者Wilhelmina Lohan