Auth design

Two separate problems, constantly conflated, with different failure modes:

• Authentication: who is this? Mature, well-solved, and you should use a library
• Authorization: what may they do? Application-specific, and where nearly all real breaches originate

Teams spend most of their effort on the first because it is visible, and most of their vulnerabilities live in the second. Object-level authorization is the one to get right.

1. Do not build authentication from scratch

Password handling, session fixation, timing attacks, reset flows, and MFA are all solved and all easy to get subtly wrong.

Use the platform's framework, or an identity provider. If you are storing passwords yourself, use argon2id or bcrypt with the current cost parameters, never a general-purpose hash, never with a hand-rolled salt.