Authentication flaws are consistently among the highest-impact findings in web application engagements — and most of them are preventable with well-known controls applied consistently.
Credentials and Sessions
- Enforce strong password policies validated against breach corpora, not arbitrary complexity rules.
- Hash with a modern memory-hard algorithm (Argon2id or scrypt) — never fast hashes like SHA-256.
- Regenerate session identifiers on login and privilege change; invalidate them server-side on logout.
Rate Limiting and Enumeration
- Rate-limit login, registration, and password reset per account and per source.
- Return identical responses and timing whether or not an account exists.
Multi-Factor Authentication
- Offer phishing-resistant options (passkeys/WebAuthn) ahead of TOTP; avoid SMS where possible.
- Rate-limit and expire MFA challenges — a 6-digit code with unlimited attempts is decoration, not security.
Recovery Flows
Password reset is an authentication bypass with better branding. Apply the same rigour: single-use time-boxed tokens, no account enumeration, and full session invalidation after reset.
Every item on this list is routinely probed within the first hours of an engagement. Better that your own testing finds the gaps first.