authentication

name	authentication
description	Use when: implement or review authentication flows, sessions, tokens, and password handling securely.

Goal: verify identity safely without leaking or mishandling credentials.

Use for:

• login, signup, and session management
• choosing between sessions and tokens
• reviewing password storage and flow security

Workflow:

1. Choose a mechanism: server sessions or signed tokens (JWT).
2. Hash passwords with a strong adaptive function (bcrypt/argon2).
3. Issue, store, and expire credentials securely.
4. Protect against brute force with rate limits and lockouts.
5. Support secure logout and token revocation.
6. Verify flows against common attacks before shipping.

Patterns:

• httpOnly, Secure, SameSite cookies for sessions
• short-lived access tokens with refresh rotation
• MFA for sensitive accounts
• constant-time comparison for secrets

Rules:

• never store passwords in plaintext or with fast hashes
• never log credentials or tokens
• always use TLS for credential transport
• expire and rotate tokens; support revocation