Authentication and sessions

Prevent business-logic flaws with server-side invariants

Recompute prices on the server, run workflows as state machines, build reset links from configuration, limit valuable flows, and turn each business rule into an invariant that the database and the tests both check.

Planning, Design, Testing · Developers, AppSec engineers

Case study: Citrix Bleed (CVE-2023-4966)

How a NetScaler memory over-read leaked session cookies that bypassed passwords and MFA in 2023, why patching did not end hijacked sessions, and how the pattern returned in 2025.

Maintenance · Developers, AppSec engineers

Operate edge rules without hiding application defects

Tune WAF and abuse controls against legitimate traffic, parser behavior and measurable business effects.

Maintenance · AppSec engineers, Platform engineers and SREs

Case study: the CircleCI security incident (January 2023)

How a session stolen from one engineer's laptop reached CircleCI's production systems and customers' stored secrets in 2023, and what platform operators and CI users should change.

Release, Maintenance · Platform engineers and SREs

Session management: cookies, timeouts, rotation and revocation

Model authentication as transitions in server authority, set session cookies and timeouts to current NIST and OWASP values, and verify fixation prevention, expiry, reauthentication, revocation and stolen-cookie defenses.

Development · Developers

Password storage: hashing parameters and rehash on login

Choose Argon2id, scrypt, PBKDF2 or bcrypt with current minimum parameters, store a versioned hash, and upgrade old hashes after a successful login without overwriting a reset.

Development · Developers

OAuth 2.0 and OpenID Connect login: authorization code with PKCE

Implement OAuth 2.0 and OpenID Connect login with the authorization code flow and PKCE, keep each transaction bound to its browser, and block redirect, mix-up, code-injection and token-theft attacks.

Development · Developers

Account recovery: password resets, help-desk resets and account linking

Treat password resets, support-desk recovery and account linking as new grants of authority: single-use high-entropy proofs, atomic consumption, session revocation, and stable identity rather than email matching.

Development · Developers, AppSec engineers

SAML single sign-on: verify signed assertions without losing the identity boundary

Bind a validated SAML assertion to its trusted issuer, the exact signed element, your service, the browser request and a replay record before creating a local session, and keep your SAML library ahead of its advisories.

Development · Developers

Stop account takeover with the right MFA and login defenses

Rank MFA options by the attacks they stop, implement TOTP and push approvals correctly, and close the login, reset and recovery paths that attackers use instead of breaking the second factor.

Development · Developers, AppSec engineers

Defend OAuth and OIDC against redirect and token attacks

Apply RFC 9700 and RFC 10017: exact redirect matching, PKCE with downgrade protection, state and iss binding, refresh-token rotation, sender-constrained tokens, and a backend-for-frontend so browser tokens cannot be stolen.

Development · AppSec engineers

Case study: the Okta support-system breach and session tokens in HAR files (2023)

How a service account password saved to a personal browser profile let an attacker download customers' HAR files from Okta's support system, replay the session tokens inside them against five customers, and stay unseen for two weeks; and why HAR files are credentials, admin sessions need binding, and every exposed credential must be rotated.

Development, Maintenance · Developers, Platform engineers and SREs

Password reset token lab: Make a recovery credential single-use

A recovery link can be redeemed twice when two requests arrive together. Repair redemption so token validation and account changes share one atomic operation.

Business logic lab: Price an order without trusting the client

A checkout trusts the price and quantity each cart line sends, adds every coupon code it recognizes, and never limits redemptions. Customers can choose their price, order negative quantities and stack discounts. Repair the pricing function so every amount comes from server data and every coupon rule holds.

OAuth redirect and PKCE lab: Match redirect URIs and verify PKCE

An authorization server accepts any redirect_uri that starts with a registered one, skips PKCE for codes issued without a challenge and accepts the plain method. Repair both checks so stolen or injected codes cannot be redeemed.

Password hashing lab: Verify and upgrade an Argon2 password hash on login

A login check verifies stored password hashes but never upgrades a weak or outdated one, so hashes created with tiny parameters or the wrong Argon2 variant stay that way forever. Repair check_login to verify with Argon2id at the policy minimum and rehash on a successful login.

Insecure randomness for security tokens

A password-reset token or session ID is only as strong as the randomness behind it.

Missing authentication for a critical function

Missing authentication for a critical function happens when a route that returns user or internal data runs without a verified caller: the endpoint has no authentication, or it reads identity from the request itself (a userId parameter, an X-Authenticated-User header an upstream proxy was supposed to set) and so authenticates nothing.

Session fixation and session cookies

A session cookie is a bearer credential: whoever presents its value is the signed-in user.