Securing Authentication Mechanisms
đź“– Securing your authentication mechanisms
- Always use two-factor authentication i.e OAuth
- If you can’t, never store passwords in plain text but always hash them. When an user authenticate, hash the input password and check if it is the same as the one saved on the database.
- Implement anti-brute-force mechanisms correctly and without errors (see here)
- Do not rely on users for security; for instance, there is the library zxcvbn that prevents the use of easily guessable passwords
- Prevent username enumeration (note: it’s also a privacy violation)
- Implement CAPTCHAs for each login attempt
- Most service also check the repution of your Ip Address
- Perform auditing of your application’s verification logic