Broken Authentication

Broken authentication covers a range of weaknesses that allow attackers to compromise user accounts without knowing the password.

Credential stuffing: Attackers use breach databases (billions of username/password pairs) against your login endpoint. Without rate limiting or breach detection, automated tools can test thousands of combinations per second.

Predictable session tokens:

# Vulnerable: sequential or time-based session IDs
session_id = str(int(time.time()))  # Predictable!
session_id = str(user_id) + "12345"  # Trivially guessable

No account lockout: Without lockout after failed attempts, brute force attacks succeed against weak passwords. Attackers use password spraying (one common password across many accounts) to avoid per-account lockout thresholds.

Insecure "Remember Me": Storing user ID in a cookie without a cryptographic signature allows attackers to forge authentication cookies by guessing other user IDs.

Implement defense-in-depth for authentication by addressing each vulnerability class systematically.

Secure password storage:

import bcrypt

# Hashing (registration)
hashed = bcrypt.hashpw(password.encode(), bcrypt.gensalt(rounds=12))

# Verification (login)
if not bcrypt.checkpw(entered.encode(), stored_hash):
    # constant-time comparison built into bcrypt
    return False

Cryptographically secure session IDs:

import secrets
session_id = secrets.token_urlsafe(32)  # 256 bits of entropy

Account lockout with progressive delay:

const LOCKOUT_THRESHOLD = 5;
const LOCKOUT_DURATION_MS = 15 * 60 * 1000; // 15 minutes

async function checkLockout(username) {
  const record = await redis.get("failures:" + username);
  if (record && record.count >= LOCKOUT_THRESHOLD) {
    const elapsed = Date.now() - record.lastFailure;
    if (elapsed < LOCKOUT_DURATION_MS) throw new Error("Account locked");
    await redis.del("failures:" + username);
  }
}

Defense checklist:

• Use bcrypt/argon2 with adequate work factor
• Generate session IDs with cryptographically secure random
• Implement account lockout and rate limiting
• Check credentials against known breach databases (HaveIBeenPwned API)
• Require MFA for sensitive accounts