auth-hardening

name	auth-hardening
description	Harden authentication systems against session fixation, brute-force attacks, and weak password storage. Covers bcrypt/argon2 hashing, JWT best practices, session management, and account lockout. Use when implementing login, fixing auth vulnerabilities, or reviewing authentication code.
version	1.0

Auth Hardening

Harden authentication to prevent unauthorized access. Weak auth is OWASP A07 and a direct path to PDPA liability -- if attackers access user data through weak login security, the developer is negligent.

The Rule

NEVER roll your own crypto. ALWAYS use proven libraries with secure defaults.

Password Hashing

The Only Acceptable Algorithms

Algorithm	When to use	Config
Argon2id	New projects (recommended)	memory: 64MB, iterations: 3, parallelism: 4
bcrypt	Existing projects, wide support	cost factor: 12+
scrypt	Alternative to Argon2	N=2^17, r=8, p=1

NEVER use: MD5, SHA-1, SHA-256 (without salt+stretch), plain text

Node.js

BAD:

import crypto from 'crypto';
const hash = crypto.createHash('sha256').(password).();