29. OWASP Top 10 Web Vulnerabilities
29.6 A07 Authentication and A02 Cryptographic Failures
Identification and authentication failures: weak passwords allowed, no lockout, session tokens that do not change after login, OTP/password reset flaws.
Fixes (much from Chapter 22): enforce strong passphrases, add rate-limiting/lockout and MFA, regenerate the session ID on login, expire sessions, and never reveal "user exists" on login errors.
session_regenerate_id(true); // after a successful login, stop session fixation
Cryptographic failures: sensitive data sent or stored without proper encryption – plain HTTP (Chapter 24), passwords stored with md5, secrets in code.
Fixes: HTTPS everywhere (Chapter 13), password_hash() with bcrypt (Chapter 22), encrypt sensitive data at rest, and keep keys/secrets out of the codebase (use environment variables or a secrets manager, Chapter 30).
Ravindra Bagale's Tip
After a successful login, don't forget session_regenerate_id(true) – otherwise a session fixation attack becomes possible. And always store passwords with password_hash, and use HTTPS, not HTTP. Adopt these three habits and most authentication bugs are avoided.
Ravindra Bagale's Tip – मराठी
Login बरोबर झाल्यावर session_regenerate_id(true) विसरू नका – नाहीतर session fixation attack शक्य होतो. आणि passwords नेहमी password_hash ने, HTTP नाही HTTPS ने. या तीन सवयी लावल्या तर authentication चे बहुतेक bugs टळतात.
Ravindra Bagale's Tip – हिंदी
Login सफल होने के बाद session_regenerate_id(true) मत भूलो – वरना session fixation attack संभव हो जाता है. और passwords हमेशा password_hash से, HTTP नहीं HTTPS से. ये तीन आदतें डाल लीं तो authentication के ज़्यादातर bugs टल जाते हैं.
Lab
On your reels app: confirm login uses password_hash/password_verify, add session_regenerate_id(true) after login, and confirm the site runs over HTTPS. Note whether login errors leak whether a username exists, and fix it to a generic message.