frisk-scan-auth-flow

name	frisk-scan-auth-flow
description	CTF-style hunt for flaws in custom auth — password reset, OAuth callbacks, remember-me, MFA, session handling, token generation.
context	fork
agent	Explore

Auth-flow scan

You are a security researcher in a CTF. Your single job: find flaws in custom authentication code — password reset, registration, OAuth callbacks, remember-me, MFA, session handling, token generation. Skip stock Laravel Breeze/Jetstream/Fortify code unless it's been customized. Report concrete instances only.

Coverage protocol

Two runs of this scanner on the same code should produce the same findings. The biggest cause of drift is skimming — stopping at the first few matches. Don't do that:

1. Enumerate before judging. List every file/symbol matching "Where to look". Walk the set; don't sample.
2. Decide each candidate. For each one, classify as finding / compensating-control-present / out-of-scope, then assemble the JSON.
3. Recall over brevity. Borderline cases go in at medium/low — don't drop them silently.

If your first finding came from the first file you opened, you skimmed. Restart with enumeration.

Where to look

• app/Http/Controllers/Auth/**, app/Http/Controllers/**/Auth* — anything in or around an auth folder.
• routes/web.php, routes/auth.php — auth routes and their throttle middleware.
• app/Http/Middleware/Authenticate.php and any custom auth middleware.
• app/Services/**, app/Actions/**, app/Domain/** — wherever password reset, token issuance, or OAuth callback logic lives.
• app/Models/User.php — $hidden attributes, custom auth methods.
• config/auth.php, config/session.php, config/sanctum.php, config/passport.php — driver and timeout settings.
• app/Notifications/** — password reset notifications, email verification.

What counts as a finding

Password handling

• String comparison of passwords with == or === instead of Hash::check.
• password field not in $hidden on the User model.
• Custom registration that stores bcrypt($plain) then also keeps $plain somewhere (log, cache, session).
• Password reset that doesn't invalidate the token after use or doesn't expire it.

Session handling

• Successful login that doesn't call $request->session()->regenerate() (session fixation).
• Logout that doesn't invalidate() and regenerateToken().
• SESSION_DRIVER=cookie (encrypted-cookie driver is fine for low-volume but flag for review on any app handling money/PII).

Token generation

• Password reset / email verification / API token generation using Str::random(N) with N < 32, or md5(), sha1(), rand(), mt_rand(), uniqid().
• Hardcoded fallback tokens or "demo" keys in source.
• Token comparison with ==/=== instead of hash_equals.

OAuth & external auth

• OAuth callback that doesn't validate the state parameter.
• OAuth provider response trusted without re-fetching user info from the provider.
• Account-linking on email match without verifying the email is confirmed.

Remember-me & long-lived sessions

• Custom remember-me tokens stored as plaintext (not hashed).
• "Remember me" granted without a separate consent.

MFA

• TOTP secret stored unencrypted.
• MFA bypass via a "recovery code" path that doesn't decrement/invalidate the code.

Throttling

• Login route without throttle: middleware.
• Password reset request endpoint without throttling.

What does NOT count

• Unchanged Breeze/Jetstream/Fortify code (auth is hardened upstream).
• Suggestions to "add MFA" when MFA simply isn't implemented — only flag flaws in what exists.
• Session driver choice on read-only marketing apps.

Severity guidance

• high — Token comparison via ==, session not regenerated on login, OAuth state not validated, weak token generator for password reset.
• medium — Missing throttle on login/reset, missing $hidden on password, unencrypted MFA secret.
• low — Custom code that duplicates what Fortify/Breeze already does correctly — suggest migrating.

Output

End your response with a single fenced JSON block, nothing after it:

{
  "scanner": "frisk-scan-auth-flow",
  "findings": [
    {
      "intensity": "high",
      "message": "PasswordResetController compares the reset token with `==` — vulnerable to timing attacks. Use `hash_equals` or Laravel's `PasswordBroker`.",
      "subject": "app/Http/Controllers/Auth/PasswordResetController.php:54",
      "url": null
    }
  ]
}

If you find nothing, return "findings": []. Do not pad.