Fix Broken Authentication with AI Prompts

Perform a comprehensive authentication security audit.

Check these areas:

Password Security:

• Passwords hashed with bcrypt/argon2
• Minimum password length (8+ chars)
• Password not in common passwords list
• No password hints stored

Session Security:

• Session IDs are random (128+ bits entropy)
• Session regenerated on login
• Secure cookie flags set
• Session timeout implemented

Login Security:

• Rate limiting on login attempts
• Account lockout after failures
• No user enumeration
• Constant-time comparison

Additional:

• 2FA option available
• Secure password reset flow
• Logout invalidates session server-side
• Auth events are logged

Report findings with severity and fix recommendations.

Implement strong password policy enforcement.

Current problem: Allowing weak passwords like "password123"

New requirements:

1. Minimum 8 characters
2. Not in top 10,000 common passwords list
3. Not same as email or username
4. No more than 3 repeated characters
5. Show password strength meter

Implementation:

• Check on registration AND password change
• Download and use common passwords list
• Client-side feedback (UX) + server-side enforcement (security)
• Don't require arbitrary complexity rules (upper+lower+number+symbol)

Modern guidance (NIST):

• Length over complexity
• Check against breach databases (HaveIBeenPwned API)
• Allow paste into password fields
• Don't force periodic password rotation

Add protection against credential stuffing attacks.

Credential stuffing: Attackers try username/password combinations from leaked databases.

Defenses:

1. Rate limiting per IP and per username
2. CAPTCHA after suspicious activity
3. Device fingerprinting
4. Login anomaly detection
5. Breach password checking

Implementation:

• Track failed logins per username (not just IP)
• After 3 failures: add CAPTCHA
• After 10 failures: temporary lockout
• Detect new device/location and require verification
• Check password against HaveIBeenPwned on registration

Alerts:

• Unusual login volume
• Logins from new countries
• Multiple accounts from same IP
• Sequential username attempts

Fix session fixation vulnerability in my application.

Session fixation: Attacker sets victim's session ID before login, then hijacks after victim authenticates.

Attack flow:

1. Attacker gets session ID from your app
2. Attacker tricks victim into using that session ID
3. Victim logs in, session becomes authenticated
4. Attacker uses known session ID to access victim's account

Fix:

1. Generate new session ID on every authentication
2. Don't accept session IDs from URL parameters
3. Don't accept session IDs from POST data
4. Only accept session ID from cookie

Implementation: // After successful login session.regenerate((err) => { // Old session ID is now invalid // New session ID issued in cookie session.userId = user.id })

Also: Regenerate on privilege escalation (user -> admin)