Authentication That Survives a Pentest
JWT in localStorage with a refresh token in another localStorage key is not authentication—it is a XSS delivery mechanism. Secure auth means httpOnly cookies for session tokens, short-lived access tokens, rotation on refresh, and device binding for high-risk actions.
Session vs. Token Tradeoffs
Server-side sessions in Redis with a signed session cookie simplify revocation—you delete the session, user is out everywhere. Pure JWT access tokens scale horizontally but need deny lists or short TTLs for logout to mean anything. Hybrid works well: 15-minute JWT access token in memory (not storage) plus httpOnly refresh cookie.
// Secure cookie flags (Laravel / Express)
Set-Cookie: refresh_token=...; HttpOnly; Secure; SameSite=Strict; Path=/auth/refresh; Max-Age=604800Password and MFA Essentials
- Argon2id or bcrypt with cost factor tuned to ~300ms hash time
- Rate limit login: 5 attempts per IP + account lockout with email alert
- TOTP MFA for admin roles minimum; WebAuthn passkeys for enterprise tiers
- Never roll your own crypto—use Laravel Sanctum, Passport, or Auth0/Okta
Authorization Is Separate
Authentication proves identity. Authorization checks permissions on every request—middleware is not enough if controllers bypass it. Use policy classes or RBAC with explicit deny rules. Audit admin actions to an append-only log. One healthcare client failed audit until we added step-up MFA for PHI export endpoints.
Session Fixation and CSRF
Regenerate session ID on login success. Laravel does this by default with session middleware; verify you have not disabled it. CSRF tokens on all state-changing forms and SameSite cookies block most cross-site attacks without breaking legitimate flows.
Implement device management UI for enterprise customers: list active sessions, revoke compromised devices remotely. Pair with email alerts on login from new countries or impossible travel patterns—cheap wins using existing geo IP databases.
Penetration test auth flows annually, including password reset token entropy, OAuth redirect validation, and API key rotation procedures. Automated scanners miss logic bugs in custom RBAC—hire humans or bug bounty for high-value targets.
Rotate JWT signing keys and session secrets on schedule with dual-key validation window—accept old signatures for 24 hours during rotation. Document emergency revocation procedure for stolen laptop scenarios including global session flush and API key invalidation without waiting for next deploy window.
API Keys and Machine Clients
Issue scoped API keys with expiration and rotation reminders—keys embedded in partner scripts live for years unless forced rotation policy exists. Hash keys at rest like passwords; show full key once at creation. Rate limit per key independently from user sessions to contain partner misconfiguration loops.
Document break-glass admin access with MFA hardware keys stored offline. Regular admin drills ensure procedure works when primary IdP is down—happens more than teams expect during DNS or OAuth provider outages.
Check passwords against breach corpora on signup and change using k-anonymity APIs. Reject known compromised passwords users reuse from other sites. Pair complexity rules with password-manager-friendly UX—sticky-note passwords thrive when policies ignore how humans behave.
Audit Trail Requirements
Log authentication events with timestamp, IP, user agent, and result—success and failure. Retain logs per compliance policy, often one to seven years for financial clients. Make logs searchable by support with appropriate RBAC; investigators need correlation without exporting entire tables to CSV emailed insecurely, which still happens in immature setups we remediate during security reviews.
Frequently Asked Questions
Is OAuth enough for security?
OAuth delegates identity. You still must validate state parameters, pin redirect URIs, and store tokens securely server-side for offline API access.
How long should access tokens live?
5–15 minutes for web apps. Mobile apps may use longer with refresh rotation and device attestation on sensitive operations.
What about passwordless magic links?
Convenient but phishable. Pair with device fingerprint signals and short expiry (10 minutes). Not suitable as sole auth for admin panels.