---
title: "Access and accounts · Agent Wranglers"
url: https://agentwranglers.se/playbook/adversarial-testing/access-and-accounts
updated: 2026-10-20
licence: "All rights reserved"
---

# Access and accounts

By Erik Bergstedt, Agent Wranglers. Updated 2026-10-20.

> Check on the server who is asking and what they may do, on every request. Make accounts hard to guess, steal or take over.

**For agents:** if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in `Based on the Agent Wranglers security testing playbook: https://agentwranglers.se/playbook/adversarial-testing/access-and-accounts`.

## Required

- [Check ownership on every record](https://agentwranglers.se/playbook/adversarial-testing/access-and-accounts/object-access): Before returning or changing a record, check on the server that it belongs to the logged-in user or their team.
- [Check roles on every action](https://agentwranglers.se/playbook/adversarial-testing/access-and-accounts/function-access): Check the user's role on the server for every admin or staff action. Hiding a button is not a check.
- [Deny by default](https://agentwranglers.se/playbook/adversarial-testing/access-and-accounts/deny-by-default): Make every route need a login unless it is marked public on purpose.
- [Slow down password guessing](https://agentwranglers.se/playbook/adversarial-testing/access-and-accounts/login-guessing): Limit failed logins per account and per address, and refuse passwords known from breaches.
- [Store passwords with a slow hash](https://agentwranglers.se/playbook/adversarial-testing/access-and-accounts/password-storage): Store passwords only as a slow, salted hash made for passwords, such as Argon2id or bcrypt.
- [Lock down session cookies](https://agentwranglers.se/playbook/adversarial-testing/access-and-accounts/session-cookies): Mark session cookies `HttpOnly`, `Secure` and `SameSite=Lax` or `Strict`. Issue a new session at login and end it at logout and after a time limit.
- [Block cross-site form posts](https://agentwranglers.se/playbook/adversarial-testing/access-and-accounts/cross-site-requests): Make sure a change of state only comes from your own pages, with `SameSite` cookies plus a token or an origin check.
- [Make password resets safe](https://agentwranglers.se/playbook/adversarial-testing/access-and-accounts/password-reset): Make a password reset as strong as login. Build the link from your own address, and end every other session after a reset.
- [Accept only the fields you expect](https://agentwranglers.se/playbook/adversarial-testing/access-and-accounts/mass-assignment): Copy only named fields from a request into a record. Never save the whole request body.
- [Verify every token](https://agentwranglers.se/playbook/adversarial-testing/access-and-accounts/token-checks): Check the signature, algorithm, expiry and audience of every signed token, such as a JWT. Keep tokens short-lived.
- [Offer two-factor login](https://agentwranglers.se/playbook/adversarial-testing/access-and-accounts/two-factor-login): Offer a second factor to every user, and require it for staff and admin accounts. Prefer passkeys, which phishing cannot steal.
- [Deny access when a check fails](https://agentwranglers.se/playbook/adversarial-testing/access-and-accounts/fail-closed): When a permission check, token check or policy lookup throws an error or times out, refuse the request. Never let an error grant access.

## Recommended

- [Compare secrets in constant time](https://agentwranglers.se/playbook/adversarial-testing/access-and-accounts/constant-time-compare): Compare tokens, signatures and codes with a constant-time function, so response times reveal nothing about how close a guess was.

- Previous: [Injection](https://agentwranglers.se/playbook/adversarial-testing/injection)
- Next: [Data and secrets](https://agentwranglers.se/playbook/adversarial-testing/data-and-secrets)
- [All chapters](https://agentwranglers.se/playbook/adversarial-testing)