Identity verified (passwords, sessions) before access

CMMC 2.0 IA.L1-3.5.2 (NIST 800-171r2 3.5.2) requires that organizational systems authenticate users, devices, and processes before granting access. Plaintext or weakly hashed passwords (MD5, SHA-1 without salt) allow an attacker who obtains the database to crack every credential in minutes using precomputed rainbow tables. Storing authentication tokens in localStorage instead of HttpOnly cookies exposes them to any XSS payload. Sessions without expiration persist indefinitely after a user's contract access is revoked. CWE-256 (Plaintext Storage of a Password) and OWASP A07 (Identification and Authentication Failures) directly name each of these failure modes.

Use bcrypt or argon2 for password hashing with a cost factor calibrated to at least 250ms on your server hardware. Set session cookies with HttpOnly, Secure, and SameSite=Lax — and a Max-Age no longer than 30 days:

// lib/auth/password.ts
import bcrypt from 'bcryptjs'
const SALT_ROUNDS = 12
export const hashPassword = (p: string) => bcrypt.hash(p, SALT_ROUNDS)
export const verifyPassword = (p: string, hash: string) => bcrypt.compare(p, hash)

// app/api/auth/login/route.ts
export async function POST(req: Request) {
  const { email, password } = await req.json()
  const user = await db.user.findUnique({ where: { email } })
  // Always run compare even for unknown emails — prevents timing attacks
  const valid = user ? await verifyPassword(password, user.passwordHash) : false
  if (!user || !valid) {
    return Response.json({ error: 'Invalid email or password' }, { status: 401 })
  }
  const token = crypto.randomUUID()
  const res = Response.json({ ok: true })
  res.headers.set('Set-Cookie',
    `session=${token}; HttpOnly; Secure; SameSite=Lax; Max-Age=1800; Path=/`
  )
  return res
}

If using Supabase Auth, NextAuth, or Clerk, verify the provider is not bypassed by any custom login route.