Secure-Code-Review (Part 2)

👨‍💻 Bugs don’t knock—🕵️‍♂️ find them before they break in! 🚪💣

Authentication And Password Management:

1. Require authentication for all resources except explicitly public ones.

2. Utilize standard , well trusted authentication service.

3. Ensure if authentication service fail securely.

4. Transmit password only over encrypted connections via HTTP POST request .

5. Enforce password complexity,length and change policies as per regulation.

6. Implement Multi-Factor-Authentication for High-Risk Accounts.

7. Notify users Lock Accounts after defined number of failed login attempts.

8. Require immediate password change for temporary credentials.

9. Regularly inspect third party authentication code for vulnerability.

10. Use Email based reset with temporary links and passwords and short expiration periods.

Session Management :

1. Use server side session management exclusively.

2. Restrict Cookie domain and path appropriately.

3. Consistently use HTTPS for all communications.

4. Terminate session fully after Logout. provide logout functionality on all protected pages.

5. Disallow persistent login and concurrent login with Same user ID.

6. Generate new session identifiers after Re-authentication , Periodic intervals or security context change.

7. Establish short session inactivity timeout.

🧠 Think before you commit. 🔍 Review before you deploy. 🔐 Stay secure.

Thank you 😎