Tech Due Diligence SEC-1: Authentication and Session Management

Start with an established identity provider rather than building authentication yourself. Services like Auth0, Keycloak, Cognito, or Firebase Auth handle the hard parts - password hashing, MFA, account lockout, session management - and keep pace with evolving best practices. If you do build custom authentication, get the fundamentals right: hash passwords with Argon2id, bcrypt (cost factor 12+), or scrypt. Never store passwords in plain text or with reversible encryption. Set a minimum password length of 12+ characters but avoid character class requirements that push users toward predictable patterns. Lock accounts after repeated failed attempts. Make multi-factor authentication available to every user. Support TOTP (authenticator apps), WebAuthn/FIDO2 (hardware keys), and SMS as a fallback. Track adoption rates and mandate MFA for all administrative accounts at a minimum. For session management, use cryptographically secure random session identifiers. Set sensible expiration times (shorter for sensitive operations) and build in session revocation so users can sign out from all devices. Protect session tokens with HttpOnly, Secure, and SameSite cookie flags, and implement CSRF protection for cookie-based sessions. Layer in attack protection: rate-limit login endpoints, detect and block credential stuffing (using IP reputation, device fingerprinting, and anomaly detection), implement account lockout with user notification, and monitor for unusual authentication patterns. For account recovery, make password reset tokens single-use, time-limited, and cryptographically random. Skip security questions entirely. If an account has MFA enabled, require MFA verification before allowing a password reset. For B2B customers, support enterprise SSO via SAML and OIDC so they can integrate with their corporate identity provider.