Access and accounts

Check on the server who is asking and what they may do, on every request. Make accounts hard to guess, steal or take over.

Required 12
Recommended 1

By Erik Bergstedt, Agent Wranglers. Updated 20 October 2026.

Required

Check ownership on every record
Required
Before returning or changing a record, check on the server that it belongs to the logged-in user or their team.
Check roles on every action
Required
Check the user's role on the server for every admin or staff action. Hiding a button is not a check.
Deny by default
Required
Make every route need a login unless it is marked public on purpose.
Slow down password guessing
Required
Limit failed logins per account and per address, offer two-factor login, and refuse passwords known from breaches.
Store passwords with a slow hash
Required
Store passwords only as a slow, salted hash made for passwords, such as Argon2id or bcrypt.
Lock down session cookies
Required
Mark session cookies HttpOnly, Secure and SameSite=Lax or Strict. Issue a new session at login and end it at logout and after a time limit.
Block cross-site form posts
Required
Make sure a change of state only comes from your own pages, with SameSite cookies plus a token or an origin check.
Make password resets safe
Required
Send a long random reset link that works once, expires within an hour, and says the same thing whether the account exists or not.
Accept only the fields you expect
Required
Copy only named fields from a request into a record. Never save the whole request body.
Verify every token
Required
Check the signature, algorithm, expiry and audience of every signed token, such as a JWT. Keep tokens short-lived.
Offer two-factor login
Required
Offer a second factor to every user, and require it for staff and admin accounts. Prefer passkeys, which phishing cannot steal.
Deny access when a check fails
Required
When a permission check, token check or policy lookup throws an error or times out, refuse the request. Never let an error grant access.

Required

Recommended