Authentication & Session Management

Principles

• Don’t build your own authentication scheme. Use the organization’s standard identity provider (OIDC/SAML) or a well-maintained library.
• Every session token and credential should have an expiry. Long-lived, non-expiring tokens are a liability.
• Treat authentication failures generically — don’t reveal whether a username exists, whether it was the password or the username that was wrong, etc.

Passwords

• Never store passwords in plaintext or with a fast hash (MD5, SHA-1, SHA-256 alone). Use a slow, salted hash designed for passwords (Argon2id, scrypt, or bcrypt).
• Enforce a minimum length (12+ characters) rather than arbitrary complexity rules.
• Check new passwords against a breached-password list (e.g. Have I Been Pwned’s k-anonymity API) where feasible.

Sessions & tokens

• Use HttpOnly, Secure, and SameSite=Lax (or Strict) cookies for session tokens.
• Rotate the session identifier on privilege change (e.g. login, elevation to admin).
• Prefer short-lived access tokens with refresh tokens over long-lived access tokens.
• Invalidate sessions server-side on logout — don’t rely solely on the client discarding the token.

Multi-factor authentication

• MFA should be available for all user accounts and required for admin/privileged accounts.
• Prefer TOTP or WebAuthn/passkeys over SMS-based MFA.

Service-to-service authentication

• Use short-lived, scoped credentials (e.g. mTLS, signed JWTs, workload identity) rather than static shared API keys wherever the platform supports it.
• Rotate any static credentials on a defined schedule and immediately on suspected compromise.