https://nalar.dev/tags/authentication/ Recent content in Authentication on Nalar Hugo en-us Wed, 02 Sep 2026 00:00:00 +0700 https://nalar.dev/design-secure-password-reset-flows/ Wed, 02 Sep 2026 00:00:00 +0700 https://nalar.dev/design-secure-password-reset-flows/ <p>Password reset is an authentication mechanism. Anyone who can complete the reset flow can usually take control of the account, so recovery deserves protections comparable to login.</p> <p>A secure design must prevent token guessing, account enumeration, replay, accidental disclosure, and long-lived takeover opportunities.</p> <h2 id="return-the-same-public-response">Return the same public response</h2> <p>A reset form often accepts an email address or username. Do not reveal whether that identifier exists.</p> <p>Prefer a response such as:</p> https://nalar.dev/prevent-session-fixation-web-authentication/ Tue, 01 Sep 2026 00:00:00 +0700 https://nalar.dev/prevent-session-fixation-web-authentication/ <p>Session fixation occurs when an attacker can cause a victim to authenticate while using a session identifier the attacker already knows. If the application keeps that identifier after login, the attacker may reuse it to access the newly authenticated session.</p> <p>The core defense is to change the session identifier whenever privilege changes.</p> <h2 id="rotate-at-authentication-boundaries">Rotate at authentication boundaries</h2> <p>After credentials, passkeys, or another authentication factor succeeds, create a fresh unpredictable session identifier and retire the pre-authentication identifier. Apply the same principle after privilege elevation, impersonation boundaries, or other security-sensitive identity changes.</p>