Skip to main content

Bundles/saas-authentication

Authentication Audit

saas-authentication · v1.1.0 · paid

Production-ready authentication assessment covering session management, login flow security, password handling, and OAuth integrations.

Session Management

session-management · weight 0.3

Session tokens use secure, HttpOnly, SameSite cookies
ab-002216
high
Session expiry is configured with a reasonable timeout
ab-002209
high
Refresh token rotation is implemented
ab-002206
high
Session is invalidated on password change
ab-002205
medium
Session fixation protection is in place
ab-002207
high
Auth tokens are not passed in URL parameters
ab-002210
high
Auth state is not stored in localStorage
ab-002208
medium
Remember-me uses a separate long-lived token
ab-002229
medium

Auth Flow Security

auth-flow · weight 0.3

Login endpoint has rate limiting
ab-002232
critical
Account lockout is implemented after failed attempts
ab-002230
high
Login form has CSRF protection
ab-002234
critical
Auth middleware protects all private routes
ab-002231
critical
Logout invalidates the server-side session
ab-002233
high
Auth error messages do not reveal whether email exists
ab-002225
medium

Password & Credential Policies

password-credential · weight 0.2

Passwords are hashed with a modern algorithm
ab-002222
critical
Plaintext passwords are not written to logs or errors
ab-002218
critical
Password strength requirements are enforced
ab-002217
medium
Password reset tokens are time-limited and single-use
ab-002227
high
Email verification is required on signup
ab-002223
high
Account recovery does not leak user information
ab-002226
medium

Social & Third-Party Auth

social-auth · weight 0.2

OAuth state parameter is validated
ab-002228
high
Social auth callback URLs are whitelisted
ab-002221
info
JWT tokens have a reasonable expiry if used
ab-002220
high
MFA option is available for users
ab-002224
info
Authentication library is on a recent release
ab-002219
info
Login UI provides clear user feedback
ab-002243
info
No default or test accounts in non-test code
ab-002246
info
Authentication events are logged for audit purposes
ab-002247
info