🧠 How authentication works (simple flow)
- User logs in (username + password)
- Server verifies credentials
- Server creates a session/token
- Browser stores it (cookie/local storage)
- Every request uses this token
👉 Problem: Most systems trust this token too much
⚠️ Common vulnerabilities
1. Session Hijacking
If attacker steals your session cookie:
👉 They can access your account without password
How it happens:
- Public WiFi (no HTTPS)
- XSS attacks
- Browser extensions
2. Session Fixation
Attacker sets a known session ID → you login → attacker uses same session
3. Weak Token Design
- No expiration
- Predictable tokens
- Not validated properly
4. JWT Misconfigurations
alg: none→ signature bypass- Weak secret → brute force
- Missing expiry → permanent access
🚨 Real-world impact
- Account takeover
- Admin access
- Financial fraud
- Data breaches
🛡️ How to secure authentication
✔ Secure cookies
- HttpOnly → JS cannot access
- Secure → only HTTPS
- SameSite → prevents CSRF
✔ Token management
- Short expiry (15–30 min)
- Refresh tokens
- Rotate tokens
✔ Re-authentication
For:
- Password change
- Payments
- Sensitive actions
✔ Multi-Factor Authentication (MFA)
Adds:
👉 Something you know + something you have
🎯 Key takeaway
👉 Authentication is not just login
👉 It must be continuously verified