Authentication & Sessions
Overview
Authentication verifies who someone is; session management keeps the application aware of that identity across requests. Both are common attack targets and common places for real security bugs.
Key concepts
- MFA, SSO, identity providers
- Brute force, credential stuffing, password spraying
- Session IDs, cookies, hijacking, fixation, expiration
How it works
Authentication
Authentication is the process of verifying the identity of a user, device, or service — controlling who can access accounts and protected content.
| Term | Meaning |
|---|---|
| Username / Password | The basic identifier and secret used to verify an account owner. |
| Multifactor authentication | Requires two or more forms of verification. |
| Single sign-on | Lets a user access multiple services with one login. |
| Identity provider | A service that verifies a user's identity for another application. |
| Password reset | Lets a user replace a forgotten or compromised password. |
| Account lockout | Temporarily blocks login attempts after too many failures. |
Common credential attacks
| Type | How it works |
|---|---|
| Brute-force attack | Repeatedly guesses passwords until the correct one is found. |
| Credential stuffing | Uses stolen username/password pairs to attempt logins elsewhere. |
| Password spraying | Tries one common password against many accounts. |
Session Management
Session management maintains a user's authenticated state after login, letting the application recognize them across multiple requests.
| Term | Meaning |
|---|---|
| Session ID / Session token | A unique value/token proving a user has an active authenticated session. |
| Cookie | Small data stored by a browser and sent with future requests to a site. |
| Session hijacking | Stealing or using another user's active session token. |
| Session fixation | Forcing a victim to use a session ID already known to the attacker. |
| Session expiration | The point when an inactive or old session becomes invalid. |
Authentication & session protection
- Require strong passwords and multifactor authentication.
- Use secure password hashing — never store passwords in plain text.
- Limit repeated login attempts and monitor failed logins.
- Generate a new session token after successful login.
- Expire sessions after inactivity and after logout.
- Use secure, HTTP-only, and SameSite cookie settings.