What’s the best way to confirm sensitive actions for SSO users without local passwords?
I'm adding Google-based SSO to an existing application where some sensitive actions currently require the user to re-enter their password, such as changing security settings or performing destructive…