authentication-security

Prevent session fixation by enforcing session lifecycle hardening that rotates session identifiers immediately after login and privilege changes, revoking old sessions to block replay attacks and privilege escalation.

Correct JWT validation requires strict enforcement of algorithm, audience, issuer, and expiry claims with clock-skew limits, combined with short-lived access tokens and single-use refresh rotation to detect compromise.

Secure cookies for web authentication by applying strict HttpOnly, Secure, SameSite, and path attributes to reduce takeover risk and prevent credential theft across login, refresh, and logout flows.

This approach works across web and service identity scenarios including OAuth, OIDC, SAML federation, passkeys, WebAuthn, and OTP-based MFA by enforcing safe issuance, rotation, and revocation behaviors.

Design safe account recovery by enforcing uniform anti-enumeration behavior, memory-hard password hashing, and auditable event logging with secret redaction to prevent weak recovery exploitation.

Refresh tokens need single-use rotation to detect compromise through refresh reuse, immediately invalidating stolen material and preventing replay attacks across service identity scenarios.