Authentication and sessions

These rules cover the security mechanics of signing in. How people sign up, which sign-in methods to offer, second factors, recovery and business sign-on live in the Accounts and identity playbook. SAML and OpenID Connect checks for business sign-on are in Connect single sign-on per organisation.

Required

• Slow down password guessing

  APS-10

  Limit failed logins per account and per client address. Give the same error for a wrong user and a wrong password.

• Store passwords with a slow hash

  APS-11

  Store passwords only as a slow, salted hash made for passwords, such as Argon2id or bcrypt.

• Verify every token

  APS-12

  Check the signature, algorithm, expiry and audience of every signed token, such as a JWT. Give access tokens a life of 15 minutes or less. This is the one home of that limit.

• Trust an email domain only after strict parsing

  APS-15

  Before an email domain grants anything, such as joining an organisation or routing single sign-on, check the address against one plain local@domain shape. Refuse quotes, comments, encoded words, % and more than one @.

• Lock down session cookies

  APS-16

  Mark session cookies HttpOnly, Secure and SameSite=Lax or Strict. Issue a new session at login and end it at logout, after idle time and after a fixed lifetime.

• Set cookies safely or not at all

  APS-17

  Set every cookie with Secure and an explicit SameSite. Add HttpOnly to every cookie that no script reads. Use SameSite=None only for a cookie that must work inside another site.

• Block cross-site form posts

  APS-18

  Make sure a change of state only comes from your own pages, with SameSite cookies plus a token or an origin check.

• Clear cached pages and data when someone signs out

  APS-19

  On sign-out, delete everything the browser stored for the account. That covers the service worker's caches, local storage and cookies.

Recommended

• Compare secrets in constant time

  APS-13

  Compare tokens, signatures and codes with a constant-time function, so response times reveal nothing about how close a guess was.

• Make tokens from a secure random source

  APS-14

  Make session IDs, reset codes, API keys and invite links only with the platform's cryptographic random generator. Never use the plain random function, a timestamp or a counter.

Read this with

• Accounts and identity playbook

  Password hashing, token checks and session cookies are the security mechanics under every sign-in.