← Web Application Security (OWASP) learning pathWeb Application Security (OWASP) · Module 3 of 10
Authentication and sessions
Protect logins and session tokens.
📖 Key ideas
- Hash passwords with slow algorithms (bcrypt, Argon2).
- Offer MFA and rate-limit login attempts.
- Session cookies: Secure, HttpOnly, SameSite.
- Regenerate session IDs after login and expire idle sessions.
- Use generic login error messages.
💡 Real-life example: A session token is a concert wristband: guard it, because anyone wearing it gets in.
Password hashingOne-way storage of passwords
MFAMulti-factor authentication
HttpOnlyCookie not readable by JavaScript
Session expiryEnding inactive sessions