Hold every sign-in path to the same checks

How to do it

OWASP ASVS 5.0 requirements 6.1.3 and 6.3.4 ask for a list of every sign-in path, each with the same strength. Attackers look for the forgotten path. Examples are an old API login, a mobile endpoint, basic authentication on an export, a token exchange or a test form left on staging. Build every session and token through one function. It checks the password or passkey, then the second factor as offer two-factor login requires. It applies the limits in slow down password guessing and refuses disabled accounts. Route handlers only collect the input and call it. Keep the list in the repository next to the routes.

Examples

JavaScript example

export const SIGN_IN_ROUTES = ['POST /sign-in', 'POST /api/v1/tokens', 'POST /oauth/token'];

export async function signIn(db, { userId, proof, secondFactor, clientKey }) {
  await guessingLimits.check(clientKey, userId);
  const user = await verifyFirstFactor(db, userId, proof);
  if (user.disabled) throw new ForbiddenError('This account is disabled.');
  if (user.hasSecondFactor) await verifySecondFactor(db, user, secondFactor);
  return sessions.create(db, user.id);
}

Python example

SIGN_IN_ROUTES = ["POST /sign-in", "POST /api/v1/tokens", "POST /oauth/token"]

def sign_in(db, user_id: str, proof, second_factor, client_key: str):
    guessing_limits.check(client_key, user_id)
    user = verify_first_factor(db, user_id, proof)
    if user.disabled:
        raise Forbidden("This account is disabled.")
    if user.has_second_factor:
        verify_second_factor(db, user, second_factor)
    return sessions.create(db, user.id)

How to check

A test collects every route whose handler sets a session cookie or returns a token, and compares them with the written list. The two match exactly. On each route, a test account with a second factor sends the right password and no code. No route returns a session or a token.

Sources

• OWASP ASVS 5.0 V6 Authentication
• OWASP Authentication Cheat Sheet

Related rules

• Offer two-factor login in Accounts
• Slow down password guessing in Security testing