authentication

Authentication Detection

Overview

Authentication establishes that a caller is the account holder they claim to be, and keeps that claim attached to subsequent requests. It sits at the very front of the request lifecycle: the login handler and its supporting flows — registration, remember-me, password reset, password change, the second-factor challenge — form the first trust boundary a request crosses, and the session issued at the end of it carries the result. It fails when the identity decision is made from data the caller controls, when guessing is not effectively limited, when a step of the flow can be skipped, when a supporting token is predictable, or when the session that encodes the result is forgeable or never rotated. The attacker is an unauthenticated outsider, or a low-privilege user climbing into a higher-privilege account; what they gain is the full authority of the account they land in. This skill finds such gaps by locating every site where identity is proved or a session is issued, verifying each one in parallel, and merging the results into <output_dir>/authentication-results.md.

What it is NOT

• Access control (/websec:access-control): the caller is already identified and the permission decision is missing or wrong. Test: if the attack requires a valid session for some account and then reaches across a boundary, it is authorization. Here the attack manufactures a session that was never legitimately issued.
• Federated login (/websec:oauth): a delegated sign-in flow, its state, redirect_uri, and token exchange. A local password flow that merely offers a social button is still judged here; the delegated flow itself is not.
• Token forgery mechanics (/websec:jwt): signature checking, algorithm pinning, claim validation of a signed token. If the session is a signed token and the weakness is in how it is validated, that is the sibling skill; if the weakness is that the login flow issues it too early or never rotates it, it is here.
• Reset-link poisoning source (/websec:host-header): the mechanism by which a request header reaches a generated URL. The reset flow's decision to trust that header for its link is judged here; a general header-reflection issue is not.
• Disclosure (/websec:information-disclosure): an error page or debug route that happens to reveal a username. An oracle that lives in an authentication endpoint — different messages, statuses, or timings for existing vs missing accounts — is judged here.
• Business logic (/websec:business-logic): domain workflows outside the credential flows — checkout, refunds, approvals — and their sequencing. This skill owns the login, registration, reset and multi-factor state machine, including a step skipped, reordered, or replayed to arrive at an authenticated state, plus any guessable code that substitutes for a credential; a guessable code that carries value but no identity (coupon, referral, gift card) is theirs.
• Counter races (/websec:race-conditions): concurrent requests slipping past an attempt counter. Note it, classify it there. Predictable token generation stays here: a reset or session token seeded from a timestamp, a weak PRNG, or a sequence is this skill's finding whatever the load, and becomes a race only when two overlapping requests collide and are handed the same value.
• Not a finding: an absence of login, lockout, or session code in a service that architecture.md records as authenticated by an external layer — a gateway, an identity provider, a shared library, or a sibling service. Read the "Enforced where" column and the trust-boundary section before reporting that a service has no authentication. Judge the external configuration where it is readable; where it is not, the label is NEEDS MANUAL REVIEW naming what a human must open. What is judged here: whether this service establishes identity from something it never verified — a user, role, or tenant header attributed to an upstream hop, a claim copied out of a request context — and whether a caller reaching it directly would be believed.
• Not a finding: a single generic failure message plus a benign redirect; timing jitter with no consistent, measurable gap; a genuinely enforced challenge after a threshold; a framework auth backend used in its documented form with its lockout and hashing settings configured.