authn-sessions-and-tokens

Authentication, Sessions and Tokens

Overview

Authentication bugs are rarely missing code; they are code that verifies the wrong thing, verifies with the wrong key, or trusts a value the attacker sends. Read every check as "what exactly is compared to what, and who chose each side?"

Core principle: the server decides the algorithm, the key, the audience and the identity — never the token, the header or the client.

1. Password Storage (CWE-916)

• ✅ argon2id, bcrypt (cost ≥ 10; note its 72-byte input limit), scrypt, or PBKDF2 with a high iteration count — through the framework's password hasher when there is one.
• ❌ MD5, SHA-1, SHA-256/512 (single or few rounds, salted or not), or reversible encryption of passwords.

# ❌
user.password = hashlib.sha256(pw.encode()).hexdigest()
# ✅
user.password = argon2.PasswordHasher().hash(pw)   # or Django's make_password

2. JWT Verification (CWE-347)

// ❌ decode() does not verify; the header's alg is trusted
const claims = jwt.decode(token);
// ❌ no algorithm pinned: an RS256 public key can be used as an HS256 secret
const claims = jwt.verify(token, publicKey);
// ✅
const claims = jwt.verify(token, publicKey, { algorithms: ["RS256"], audience: "api", issuer: ISS });

# ❌
jwt.decode(token, options={"verify_signature": False})
# ✅
jwt.decode(token, key, algorithms=["RS256"], audience="api", issuer=ISS)

Also: alg: none accepted; exp/aud/iss not checked; the key chosen by a kid header used in a file path or SQL query; keys fetched from a token-supplied jku/x5u URL (SSRF and forged keys); a token accepted for a different audience than this service.

3. Sessions and Cookies

• Fixation (CWE-384): the session id is not rotated at login or privilege change.
• Logout: a server-side session or refresh token that survives logout (only the cookie is cleared) — MEDIUM.
• Cookie flags: HttpOnly, Secure, SameSite missing is hardening — report only with a concrete chain (a session cookie readable by script on a page with a real XSS sink in this diff).
• Token in localStorage: not a finding by itself; it raises the impact of an XSS.
• Step skipping: an endpoint reachable after the password step but before MFA completes treats the half-authenticated session as full.