AuthN & Session Management Checks

Scope & Objectives

• Audit every path that establishes identity (login, register, SSO/OAuth callback), extends it (remember-me, refresh tokens), or re-establishes it (password reset, recovery).
• Verify credentials are checked against strong one-way hashes and that sessions/tokens are issued, rotated, validated, and invalidated correctly.
• Detect enumeration, brute-force enablement, default/seeded credentials, mass assignment at registration, MFA bypasses, and JWT algorithm/validation flaws.
• Out of scope (cross-references): throttling depth and API abuse metrics -> api.md; object-level IDOR beyond reset-flow specifics -> authz.md; cookie attribute deep matrix -> config.md; hardcoded secret inventory -> secrets.md; redirect validation depth -> ssrf.md.

Prerequisites & Vocabulary

Zero-background primer: the terms this module uses, one line each. Deeper plain-language explanations for every class live in the repository GUIDE.md glossary.