Authentication Failures Skill

Authentication failures include broken login flows, weak session management, and credential handling that is technically functional but exploitable. An agent implementing an auth flow will produce something that works. The question is whether it resists brute force, session fixation, credential stuffing, and token leakage.

What to Check Before Writing Auth Code

1. Rate limiting on login and credential endpoints Login, password reset, and MFA verification endpoints must have rate limiting. Without it, brute force and credential stuffing are possible. State the limit: requests per minute, lockout threshold, and lockout duration.

2. Session management Sessions must be invalidated on logout. Session tokens must be regenerated after privilege escalation (e.g., after login, after MFA completion). Session tokens must not appear in URLs.

3. Token security JWTs must use a strong algorithm (RS256, ES256, HS256 with a secret of 32+ bytes). The alg: none attack must be blocked. JWT secrets must not be hardcoded. Token expiry must be set.

4. Password policy Minimum length of 8 characters. No maximum length below 64 characters (password truncation is a vulnerability). Rejection of known breached passwords (Have I Been Pwned list) is best practice.