diff --git a/config/gdpr.php b/config/gdpr.php
index 616cefc..32bd457 100644
--- a/config/gdpr.php
+++ b/config/gdpr.php
@@ -29,6 +29,18 @@
         'auth',
     ],
 
+    /*
+    |--------------------------------------------------------------------------
+    | Re-authentication
+    |--------------------------------------------------------------------------
+    |
+    | Only authenticated users should be able to download their data.
+    | Re-authentication is recommended to prevent information leakage.
+    |
+    */
+
+    're-authenticate' => true,
+
     /*
     |--------------------------------------------------------------------------
     | Cleanup Strategy
diff --git a/src/Http/Controllers/GdprController.php b/src/Http/Controllers/GdprController.php
index 9fd3059..e38d2b8 100644
--- a/src/Http/Controllers/GdprController.php
+++ b/src/Http/Controllers/GdprController.php
@@ -18,7 +18,7 @@ class GdprController extends Controller
      */
     public function download(GdprDownload $request)
     {
-        if (!$this->attemptLogin($request)) {
+        if (!$this->validateRequest($request)) {
             return $this->sendFailedLoginResponse();
         }
 
@@ -38,19 +38,34 @@ public function download(GdprDownload $request)
     }
 
     /**
-     * Attempt to log the user into the application.
+     * Validate the request.
      *
      * @param  \Illuminate\Foundation\Http\FormRequest  $request
      * @return bool
      */
-    protected function attemptLogin(FormRequest $request)
+    protected function validateRequest(FormRequest $request)
+    {
+        if (config('gdpr.re-authenticate', true)) {
+            return $this->hasValidCredentials($request);
+        }
+
+        return Auth::check();
+    }
+
+    /**
+     * Validate a user's credentials.
+     *
+     * @param  \Illuminate\Foundation\Http\FormRequest  $request
+     * @return bool
+     */
+    protected function hasValidCredentials(FormRequest $request)
     {
         $credentials = [
             $request->user()->getAuthIdentifierName() => $request->user()->getAuthIdentifier(),
             'password'                                => $request->input('password'),
         ];
 
-        return Auth::attempt($credentials);
+        return Auth::validate($credentials);
     }
 
     /**
diff --git a/src/Http/Requests/GdprDownload.php b/src/Http/Requests/GdprDownload.php
index 544e2aa..edccdf8 100644
--- a/src/Http/Requests/GdprDownload.php
+++ b/src/Http/Requests/GdprDownload.php
@@ -24,7 +24,7 @@ public function authorize()
     public function rules()
     {
         return [
-            'password' => 'required|string',
+            'password' => 'string',
         ];
     }
 }