authentication

Goal: verify identity safely without leaking or mishandling credentials. Use for: - login, signup, and session management - choosing between sessions and tokens - reviewing password storage and flow security Workflow: 1. Choose a mechanism: server sessions or signed tokens (JWT). 2. Hash passwords with a strong adaptive function (bcrypt/argon2). 3. Issue, store, and expire credentials securely. 4. Protect against brute force with rate limits and lockouts. 5. Support secure logout and token revocation. 6. Verify flows against common attacks before shipping. Patterns: - httpOnly, Secure, SameSite cookies for sessions - short-lived access tokens with refresh rotation - MFA for sensitive accounts - constant-time comparison for secrets Rules: - never store passwords in plaintext or with fast hashes - never log credentials or tokens - always use TLS for credential transport - expire and rotate tokens; support revocation