A2 – Building proper authentication and session management
Flawed authentication and session management are the second most critical vulnerability in web applications nowadays.
Authentication is the process whereby users prove that they are who they say they are; this is usually done through usernames and passwords. Some common flaws in this area are permissive password policies and security through obscurity (lack of authentication in supposedly hidden resources).
Session management is the handling of session identifiers of logged users; in Web servers this is done by implementing session cookies and tokens. These identifiers can be implanted, stolen, or "hijacked" by attackers by social engineering, cross-site scripting or CSRF, and so on. Hence, a developer must pay special attention to how this information is managed.
In this recipe, we will cover some of the best practices when implementing username/password authentication and to manage the session identifiers of logged users.
