Step-up auth for transfers/wires/payments

A session token that grants access to wire transfers and payments is the highest-value credential in a financial application. If that token is stolen — via XSS, network interception, or session fixation — the attacker can execute high-value transactions without any additional authentication barrier. Step-up authentication requires a second proof-of-identity at the moment the sensitive operation is initiated, so a stolen token alone is insufficient. CWE-306 (Missing Authentication for Critical Function), OWASP A07, PCI-DSS Req 8.4, and NIST 800-63B IA-11 all address this gap. Without server-side step-up enforcement, client-side UI guards are trivially bypassed with a direct API call.

Enforce step-up via server-side middleware, not client state, in src/middleware/requireStepUp.ts:

export async function requireStepUp(req: Request): Promise<Response | null> {
  const session = await getSession(req);
  const verified = await checkStepUpStatus(session.id);
  if (!verified) {
    return Response.json(
      { error: 'Step-up authentication required' },
      { status: 403 }
    );
  }
  return null; // proceed
}

// src/app/api/transfer/route.ts
export async function POST(req: Request) {
  const block = await requireStepUp(req);
  if (block) return block;
  // safe to process transfer
}

Apply requireStepUp to every sensitive route: transfers, wires, payments, account changes, and password resets. Do not rely on a client-side flag or cookie indicating that step-up was completed — verify the server-side step-up record on every request.