javascript-identification-authentication-failures

JavaScript Identification and Authentication Failures (OWASP A07:2021)

actions:

• type: enforce conditions:

  Pattern 1: Weak Password Validation

  • pattern: "(?:password|passwd|pwd)\s*\.\s*(?:length\s*[<>]=?\s*(?:[0-9]|10)\b|match\(\s*['"][^'"]['"]\s\))" message: "Weak password validation detected. Implement strong password policies requiring minimum length, complexity, and avoiding common passwords."

  Pattern 2: Missing MFA Implementation

  • pattern: "(?:login|signin|authenticate|auth)\s*\([^)]\)\s\{[^}]*?\}" negative_pattern: "(?:mfa|2fa|two-factor|multi-factor|otp|totp)" message: "Authentication implementation without multi-factor authentication (MFA). Consider implementing MFA for enhanced security."

  Pattern 3: Hardcoded Credentials

  • pattern: "(?:const|let|var)\s+(?:password|passwd|pwd|secret|key|token|apiKey)\s*=\s*['"][^'"]+['"]" message: "Hardcoded credentials detected. Store sensitive authentication data in secure configuration or environment variables."

  Pattern 4: Insecure Session Management

  • pattern: "(?:localStorage|sessionStorage)\.setItem\('"['"]" message: "Storing authentication tokens in localStorage or sessionStorage. Consider using HttpOnly cookies for sensitive authentication data."

  Pattern 5: Missing CSRF Protection

  • pattern: "(?:post|put|delete|patch)\([^)]*?\)" negative_pattern: "(?:csrf|xsrf|token)" location: "(?:src|components|pages|api)" message: "Potential missing CSRF protection in API requests. Implement CSRF tokens for state-changing operations."

  Pattern 6: Insecure JWT Handling

  • pattern: "jwt\.sign\([^)]?{[^}]?}\s*,\s*[^,)]+\s*(?:\)|,\s*{\s*(?:expiresIn|algorithm)\s*:\s*[^}]?}\s\))" negative_pattern: "(?:expiresIn|exp).*(?:algorithm|alg)" message: "Insecure JWT configuration. Ensure JWTs have proper expiration and use secure algorithms (RS256 preferred over HS256)."

  Pattern 7: Insecure Password Storage

  • pattern: "(?:bcrypt|argon2|pbkdf2|scrypt)\.[^(]\([^)]?(?:rounds|iterations|cost|factor)\s*[:<=>]\s*(?:[0-9]|1[0-2])\b" message: "Weak password hashing parameters. Use sufficient work factors for password hashing algorithms."

  Pattern 8: Missing Account Lockout

  • pattern: "(?:login|signin|authenticate|auth)\s*\([^)]\)\s\{[^}]*?\}" negative_pattern: "(?:lock|attempt|count|limit|throttle|rate)" message: "Authentication implementation without account lockout or rate limiting. Implement account lockout after failed attempts."

  Pattern 9: Insecure Password Recovery

  • pattern: "(?:reset|forgot|recover)(?:Password|Pwd)\s*\([^)]\)\s\{[^}]*?\}" negative_pattern: "(?:expire|timeout|token|verify)" message: "Potentially insecure password recovery mechanism. Implement secure, time-limited recovery tokens."

  Pattern 10: Missing Brute Force Protection

  • pattern: "(?:login|signin|authenticate|auth)\s*\([^)]\)\s\{[^}]?\}" negative_pattern: "(?:captcha|recaptcha|hcaptcha|rate\slimit)" message: "Authentication without CAPTCHA or rate limiting. Implement protection against brute force attacks."

  Pattern 11: Insecure Remember Me Functionality

  • pattern: "(?:rememberMe|keepLoggedIn|staySignedIn)" negative_pattern: "(?:secure|httpOnly|sameSite)" message: "Potentially insecure 'Remember Me' functionality. Implement with secure, HttpOnly cookies and proper expiration."

  Pattern 12: Insecure Logout Implementation

  • pattern: "(?:logout|signout)\s*\([^)]\)\s\{[^}]?\}" negative_pattern: "(?:invalidate|revoke|clear|remove).(?:token|session|cookie)" message: "Potentially incomplete logout implementation. Ensure proper invalidation of sessions and tokens on logout."