Authentication

2 articles

Cybersecurity 02 Sep 2026 5 min read

Design Secure Password Reset Flows

Password reset is an authentication mechanism. Anyone who can complete the reset flow can usually take control of the account, so recovery deserves protections comparable to login. A secure design must prevent token guessing, account enumeration, replay, accidental disclosure, and long-lived takeover opportunities. Return the same public response A reset form often accepts an email address or username. Do not reveal whether that identifier exists. Prefer a response such as:

Cybersecurity Authentication

Cybersecurity 01 Sep 2026 3 min read

Prevent Session Fixation During Web Authentication

Session fixation occurs when an attacker can cause a victim to authenticate while using a session identifier the attacker already knows. If the application keeps that identifier after login, the attacker may reuse it to access the newly authenticated session. The core defense is to change the session identifier whenever privilege changes. Rotate at authentication boundaries After credentials, passkeys, or another authentication factor succeeds, create a fresh unpredictable session identifier and retire the pre-authentication identifier. Apply the same principle after privilege elevation, impersonation boundaries, or other security-sensitive identity changes.

Cybersecurity Authentication