Authentication & Session Management

#Proving Identity on the Web#link

Authentication — verifying who a user is — is one of the most critical security functions in any web application. Broken authentication is consistently a top vulnerability category in the OWASP Top 10. In this lesson, we'll explore how authentication works, how sessions are maintained, and the common pitfalls that lead to security breaches.

How Authentication Works

The authentication flow in a typical web application follows this pattern: the user provides credentials (usually username + password), the server verifies them against stored data, and if valid, creates a session that identifies the user for subsequent requests.

1. User submits credentials → POST /login {username, password}
2. Server looks up user in database
3. Server compares password hash with stored hash
4. If match → Server creates session, sends session cookie
5. Browser includes session cookie in all subsequent requests
6. Server validates session on each request

Password Storage: Hashing

Passwords must NEVER be stored in plaintext. Instead, they're processed through a one-way cryptographic hash function. When a user logs in, the submitted password is hashed and compared to the stored hash.

import bcrypt

# Registration: Hash the password before storing
password = "user_password_123".encode('utf-8')
salt = bcrypt.gensalt(rounds=12)
password_hash = bcrypt.hashpw(password, salt)
# Store password_hash in database

# Login: Verify the submitted password
submitted = "user_password_123".encode('utf-8')
if bcrypt.checkpw(submitted, stored_hash):
    print("Authentication successful")
else:
    print("Invalid credentials")

Session Management

After authentication, the server needs to remember who the user is across multiple HTTP requests (which are stateless). This is done through sessions. The server creates a session, stores data server-side, and sends a session ID to the client as a cookie.

// Express.js session setup
const session = require('express-session');

app.use(session({
    secret: process.env.SESSION_SECRET,
    resave: false,
    saveUninitialized: false,
    cookie: {
        httpOnly: true,    // Prevent JavaScript access
        secure: true,      // HTTPS only
        sameSite: 'strict', // CSRF protection
        maxAge: 3600000    // 1 hour expiration
    }
}));

// After successful authentication
app.post('/api/login', async (req, res) => {
    const user = await authenticateUser(req.body);
    if (user) {
        req.session.userId = user.id;
        req.session.role = user.role;
        res.json({ status: 'success' });
    } else {
        res.status(401).json({ error: 'Invalid credentials' });
    }
});

JSON Web Tokens (JWT)

JWTs are an alternative to server-side sessions. A JWT is a self-contained token that carries user data (claims) and is cryptographically signed. The server doesn't need to store session data — it just validates the token's signature.

{
  "header": {
    "alg": "HS256",
    "typ": "JWT"
  },
  "payload": {
    "sub": "1234567890",
    "username": "alice",
    "role": "admin",
    "iat": 1516239022,
    "exp": 1516242622
  },
  "signature": "HMACSHA256(base64(header) + '.' + base64(payload), secret)"
}

Common Authentication Vulnerabilities

• ▪Credential stuffing — Using leaked username/password pairs from other breaches
• ▪Brute force — Automated guessing of passwords without rate limiting
• ▪Session fixation — Forcing a user to use a known session ID
• ▪Session hijacking — Stealing a valid session token (via XSS, network sniffing)
• ▪Weak password policies — Allowing simple passwords like 'password123'
• ▪Insecure password recovery — Security questions, email-only reset without verification
• ▪Missing MFA — Single factor authentication for sensitive operations
• ▪Privilege escalation — Modifying role/permission parameters in requests

Multi-Factor Authentication (MFA)

MFA requires two or more verification factors: something you know (password), something you have (phone/token), and something you are (biometric). Even if an attacker obtains the password, they cannot authenticate without the second factor.