authentication-security

Authentication Security

Quick Navigation: Level 1: Quick Start (5 min) → Level 2: Implementation (30 min) → Level 3: Mastery (Extended)

Level 1: Quick Start (<2,000 tokens, 5 minutes)

Core Principles

1. Multi-Factor Always: Require MFA for sensitive operations (TOTP, WebAuthn, hardware keys)
2. Secure Tokens: Use RS256 for JWT, never HS256 with shared secrets in distributed systems
3. Short-Lived Tokens: Access tokens <15 min, refresh tokens with rotation
4. OAuth2 with PKCE: Always use PKCE for SPAs and mobile apps
5. Session Security: httpOnly, secure, sameSite cookies with CSRF protection

Essential Checklist

• OAuth2 flow: Authorization code with PKCE for public clients
• JWT signing: RS256 asymmetric keys, never embed secrets in tokens
• Token expiration: Access <15 min, refresh <7 days with rotation
• MFA enabled: TOTP (Google Authenticator) or WebAuthn (hardware keys)
• Session cookies: httpOnly=true, secure=true, sameSite=strict
• CSRF protection: State parameter for OAuth2, CSRF tokens for sessions
• Password storage: bcrypt (cost≥12) or argon2id, never plaintext/MD5/SHA1
• Account lockout: 5 failed attempts → temporary lockout (AC-7)
• TLS required: All auth endpoints require HTTPS (SC-8)
• Audit logging: Log all auth events with timestamps (AU-2)

Quick Example

// @nist ia-2 "Identification and authentication"
// @nist ia-5 "Authenticator management"
const jwt = require('jsonwebtoken');
const fs = require('fs');

// ❌ NEVER do this (shared secret, symmetric)
// const token = jwt.sign({ userId: 123 }, 'hardcoded_secret', { algorithm: 'HS256' });

// ✅ Use RS256 with private/public keypair
const privateKey = fs.readFileSync('./keys/private.pem');
const publicKey = fs.readFileSync('./keys/public.pem');

function generateAccessToken(userId) {
  return jwt.sign(
    {
      sub: userId,
      iss: 'auth.example.com',
      aud: 'api.example.com'
    },
    privateKey,
    {
      algorithm: 'RS256',
      expiresIn: '15m'  // Short-lived
    }
  );
}

function verifyToken(token) {
  try {
    return jwt.verify(token, publicKey, {
      algorithms: ['RS256'],
      issuer: 'auth.example.com',
      audience: 'api.example.com'
    });
  } catch (err) {
    throw new Error('Invalid token');
  }
}