kimtth Goal: verify identity safely without leaking or mishandling credentials.
Use for:
- login, signup, and session management
- choosing between sessions and tokens
- reviewing password storage and flow security
Workflow:
- Choose a mechanism: server sessions or signed tokens (JWT).
- Hash passwords with a strong adaptive function (bcrypt/argon2).
- Issue, store, and expire credentials securely.
- Protect against brute force with rate limits and lockouts.
- Support secure logout and token revocation.
- Verify flows against common attacks before shipping.
Patterns:
- httpOnly, Secure, SameSite cookies for sessions
- short-lived access tokens with refresh rotation
- MFA for sensitive accounts
- constant-time comparison for secrets
Rules:
- never store passwords in plaintext or with fast hashes
- never log credentials or tokens
- always use TLS for credential transport
- expire and rotate tokens; support revocation