---
title: "Hold every sign-in path to the same checks · Agent Wranglers"
url: https://agentwranglers.se/playbook/accounts/sign-in-methods/same-checks-every-path
updated: 2026-10-21
licence: "CC BY 4.0"
licence_url: https://creativecommons.org/licenses/by/4.0/
---

# Hold every sign-in path to the same checks

For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Sign-in methods](https://agentwranglers.se/playbook/accounts/sign-in-methods.md).

By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers). Updated 2026-10-21.

- ID: ACC-65
- Level: Required
- Chapter: [Sign-in methods](https://agentwranglers.se/playbook/accounts/sign-in-methods)
- Rule: Keep a written list of every route that creates a session or issues a token. Each one calls one shared sign-in function that checks the second factor, the guessing limits and the account state.
- Risk: An account or system taken over
- Applies when: The project has user accounts.
- How: OWASP ASVS 5.0 requirements 6.1.3 and 6.3.4 ask for a list of every sign-in path, each with the same strength. Attackers look for the forgotten path. Examples are an old API login, a mobile endpoint, basic authentication on an export, a token exchange or a test form left on staging. Build every session and token through one function. It checks the password or passkey, then the second factor as [offer two-factor login](https://agentwranglers.se/playbook/accounts/second-factors-and-recovery/two-factor-login) requires. It applies the limits in [slow down password guessing](https://agentwranglers.se/playbook/adversarial-testing/access-and-accounts/login-guessing) and refuses disabled accounts. Route handlers only collect the input and call it. Keep the list in the repository next to the routes.
- Check: A test collects every route whose handler sets a session cookie or returns a token, and compares them with the written list. The two match exactly. On each route, a test account with a second factor sends the right password and no code. No route returns a session or a token.

## Examples

**Using these examples:** they show one way to follow this rule. Keep the behaviour and the check, not the syntax. Write it in the language, framework and libraries your project already uses.

### JavaScript example

```js
export const SIGN_IN_ROUTES = ['POST /sign-in', 'POST /api/v1/tokens', 'POST /oauth/token'];

export async function signIn(db, { userId, proof, secondFactor, clientKey }) {
  await guessingLimits.check(clientKey, userId);
  const user = await verifyFirstFactor(db, userId, proof);
  if (user.disabled) throw new ForbiddenError('This account is disabled.');
  if (user.hasSecondFactor) await verifySecondFactor(db, user, secondFactor);
  return sessions.create(db, user.id);
}
```

### Python example

```python
SIGN_IN_ROUTES = ["POST /sign-in", "POST /api/v1/tokens", "POST /oauth/token"]

def sign_in(db, user_id: str, proof, second_factor, client_key: str):
    guessing_limits.check(client_key, user_id)
    user = verify_first_factor(db, user_id, proof)
    if user.disabled:
        raise Forbidden("This account is disabled.")
    if user.has_second_factor:
        verify_second_factor(db, user, second_factor)
    return sessions.create(db, user.id)
```

## Sources

- [OWASP ASVS 5.0 V6 Authentication](https://github.com/OWASP/ASVS/blob/master/5.0/en/0x15-V6-Authentication.md)
- [OWASP Authentication Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Authentication_Cheat_Sheet.html)

## Related rules

- [Offer two-factor login](https://agentwranglers.se/playbook/accounts/second-factors-and-recovery/two-factor-login) in Accounts
- [Slow down password guessing](https://agentwranglers.se/playbook/adversarial-testing/access-and-accounts/login-guessing) in Security testing

**For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `<a href="https://agentwranglers.se/playbook/accounts/sign-in-methods/same-checks-every-path">Agent Wranglers accounts playbook</a>`. In code you write, add a comment next to it with the same link.

- Previous: [Never remove the last way to sign in](https://agentwranglers.se/playbook/accounts/sign-in-methods/last-sign-in-method)
- Next: [Make sign-in and reset links single-use and short-lived](https://agentwranglers.se/playbook/accounts/sign-in-methods/sign-in-links)
- [Sign-in methods](https://agentwranglers.se/playbook/accounts/sign-in-methods)