Authentication is the basis for trust on the web. A compromise in this area may not be as flashy as in other aspects of the application, but the impact is critical. A break in authentication or session management renders all other security measures moot. Teaching customers understand this is important, but we need to advocate for greater adoption of temporal 2FA, reuse of standardized and well-understood frameworks versus home grown portals, and continual penetration testing throughout all phases of the software development lifecycle to ensure that the maturation of an application does not leave a credible, hardened authentication unfinished.
In this chapter, we saw how there are many ways in which web applications can identify and verify users and assign privileges. We now have the tools to test both the resiliency of session management within the application as well...