In most applications, authentication is a boolean. You are logged in or you are not, and once you are, everything is open: viewing your invoices, changing your email address, deleting your account, generating an API key.

Yet "logged in" covers very different situations. A session opened a minute ago with a password and a code. A session restored this morning by a "remember me" cookie set three weeks ago. A computer left unlocked over lunch. A session cookie stolen by a browser extension. To read a dashboard, the difference hardly matters. To change the address used to reset the password, it matters a lot.

GitHub asks for your password again before you delete your account or create an access token. Your bank asks for a code before a transfer to a new payee. This is called step-up authentication: you don't ask for everything all the time, but for an extra proof at the moment it counts.

Symfony 8.2 finally brings the building blocks to do it properly.…