Establishing who the user is.
WHAT OPTIONS EXIST
Email and password One-time codes by message Platform sign-in Third-party identity providers Passkeys
WHAT TO PREFER WHERE POSSIBLE
Established identity providers, rather than handling passwords yourself.
WHY
Password handling is easy to implement subtly wrong.
WHAT TO KNOW ABOUT CODES BY MESSAGE
They can be intercepted or redirected, and delivery is unreliable and costly.
WHAT TO SUPPORT ON THE PLATFORM
Automatic filling of one-time codes, which the system provides.
WHAT TO STORE
Tokens, in secure storage, never in preference storage.
WHAT TO IMPLEMENT
Token refresh, without requiring the user to sign in repeatedly Sign-out that revokes server-side, not only locally
WHY SERVER-SIDE
Otherwise a stolen token remains valid.
WHAT TO HANDLE
Expiry, gracefully, returning the user to where they were.
WHAT TO ADD FOR SENSITIVE ACTIONS
Re-authentication, or biometric confirmation.
WHAT TO NEVER DO
Decode a token on the client and trust its contents for authorisation Keep a session valid indefinitely
WHAT TO ALLOW
Pasting into every field, including codes.
