Authentication Security

2 articles

Cybersecurity 04 Sep 2026 11 min read

Rotate Session Identifiers After Authentication

A web application often creates a session before a user signs in. The session may hold a shopping cart, a language preference, or state needed during an authentication flow. After login, it is tempting to keep the same session identifier and simply mark that session as authenticated. That creates a security problem if someone else already knows or influenced the pre-login identifier. Authentication has increased what the session is allowed to do, but the credential used to refer to that session has not changed. A previously low-value identifier may suddenly become a key to an authenticated account.

Cybersecurity Session Security

Cybersecurity 04 Sep 2026 10 min read

Design Rate Limits Around Security Identities

A rate limit sounds simple: allow only a certain number of requests during a period. The difficult security question is not the number. It is what you count together. Suppose a login endpoint allows five failed attempts per minute from each IP address. That can slow one client, but an attacker using many addresses can still make many guesses against the same account. Change the rule to five failures per account and another problem appears: anyone who knows a username may be able to keep that user’s account throttled.

Cybersecurity Rate Limiting