Protected by hardened password controls, short-lived authentication flows, and server-side sessions.
This confirmation authorizes for five minutes in this session.