Authentication flaws

Authentication is how a site decides you are who you say you are. It is not one feature but a chain — the login, the session that remembers you afterwards, and the recovery flow when you forget your password. An attacker only needs the weakest link. In this lesson we break three of them and then build each back correctly.

The login

A login fails safely only if guessing is expensive. Three things make it cheap:

• Weak or common passwords. If ravens123 is allowed, someone will try it.
• No rate limiting. Without a limit or lockout, an attacker makes thousands of attempts.
• User enumeration. If “no such user” and “wrong password” are different messages, an attacker first learns which usernames exist, then focuses the guessing.

app.post('/login', rateLimit({ max: 5, per: '15m', lockout: true }), async (req, res) => {
  const user = db.user(req.body.username);
  const ok = user && await bcrypt.compare(req.body.password, user.hash);
  if (!ok) return res.json({ error: 'Invalid username or password' }); // one message
  login(res, user);
});

The session

After login the server gives you a token that proves, on later requests, that you already logged in. If that token is predictablePossible to produce or infer without secret knowledge — for example derived from the user id or a counter., an attacker forges someone else’s. A token like user-2 is a gift: change the number and you are user 1.

A session token must be long, random, from a secure generator, and stored server-side tied to the user — carrying no editable meaning inside it. Set the cookie HttpOnly; Secure; SameSite, and invalidate the session on logout.

The password reset

The reset flow can hand over an account without any password at all. The token emailed to the user must be the only way to reset, so it must be a secret the attacker cannot produce.

A reset token must be long and random, tied to the account, short-lived, single-use, and delivered only to the owner’s channel — never shown to whoever requested it.

How to prevent it

Treat the whole chain as one: strong hashed passwords with rate limiting and one uniform error; random server-side sessions with secure cookie flags; random, short-lived, single-use reset tokens; and multi-factor authentication for privileged accounts. Lean on a vetted framework rather than hand-rolling any of these.