Three Scope Tiers for a Half Signed In Session
Part of the Refresh Token Design series. Signing In Is Not a Boolean Most auth code treats the session as a switch. Either somebody is in or they are not. Real sign-in has states in between, and each one needs a session that exists and reaches almost nothing. Somebody types a correct password and owes a second factor. They are not signed in, but they have to be able to call the route that lists their factors, the route that sends a code, and the route that verifies one. Those routes need to know who is answering, which means a session, which means a token. ...