Per the current plans, AuthManager (T91699) has a timeSinceAuthentication() method which can be used by clients to force reauthentication on sensitive pages unless the user has authenticated recently. This does not cover some important use cases:

1. We have a secondary authentication method that is inconvenient (e.g. smartcard login) or expensive (e.g. SMS one-time password) enough that we do not want to use it on every login but we do want to use it on some sensitive pages.
2. We want to allow certain operations for certain session types (e.g. user coming from trusted IP address) only. Non-auth-related code should not know about the specifics; it should only have a way to signal that it is about to perform a high-security function (which itself might or might not be auth-related, e.g. password change or checkuser).
3. We want force reauthentication with an extra secondary check when the session is somehow suspicious (e.g. the user is suddenly connecting from the other end of the world).

AuthManager needs to know if the last authentication included that secondary method, and needs to be able to tell the relevant secondary provider that this is a high-security reauthentication and it should be active.

One possible approach to cover these is to have a hook by which interested parties (mainly the special page or action controller and the session handler) can signal the need for extra verification by elevating the security level; the session handler would receive the security level as part of its getSessionUserInfo call and alter its behavior based on that (e.g. a cookie-based handler could track cookie age via a session variable and refuse non-recent cookies; an IP-based handler could restrict itself to highly trusted addresses). When reauthentication is needed, the security level would be passed to providers as well. This would require storing the security level of a successful authentication somehow.