Authentication and Sessions
Authentication answers who are you? Authorization answers what are you allowed to do? A secure application must perform both checks on the server.
Authentication answers who are you? Authorization answers what are you allowed to do? A secure application must perform both checks on the server.
Password handling
Applications should store password hashes produced by a modern password-hashing algorithm, not plaintext or fast general-purpose hashes. Rate limiting, multi-factor authentication and secure recovery flows reduce account-takeover risk.
Sessions
After login, a server often creates a session and sends a random identifier in a cookie. Secure session cookies should normally use:
Secureso they travel only over HTTPS.HttpOnlyto reduce access from client-side scripts.- an appropriate
SameSitepolicy.
Session identifiers must be unpredictable, rotated after authentication and invalidated on logout or account-security changes.
Authorization checks
Never trust a user-supplied account ID or role. Each sensitive request must verify that the authenticated user is permitted to access the requested object or action.
Test these concepts only in an authorized environment.