Identifying users.
WHAT A SESSION IS
A way of remembering a visitor between requests.
HOW IT WORKS
An identifier stored with the visitor, matched to data held server-side or signed.
WHAT TO USE
Your framework's session handling.
Not your own.
WHAT TO CONFIGURE
A strong secret key, from configuration rather than code Cookies marked secure and inaccessible to scripts A sensible expiry
WHAT TO NEVER DO
Store passwords in plain form Write your own password hashing Place sensitive data in a cookie the client can read
HOW TO STORE PASSWORDS
Using an established hashing function designed for passwords.
Your framework or a standard library provides one.
WHAT ELSE TO IMPLEMENT
Rate limiting on login attempts A second authentication step, where warranted Session invalidation on password change
THAT LAST POINT
Changing a password should end existing sessions.
WHAT TO LOG
Authentication failures, without the credentials.
WHAT TO CHECK
That authorisation is enforced on every protected route, not only hidden in the interface.
