Comprehensive Authentication Guide#
A practitioner’s reference for authentication security — protocols, mechanisms, vulnerabilities, exploitation techniques, and defense strategies. Covers traditional and modern authentication methods from enterprise to web applications. Compiled from 23 research sources.
Table of Contents#
- Fundamentals
- Password-Based Authentication
- Multi-Factor Authentication (MFA)
- OAuth 2.0 & OpenID Connect
- SAML & Enterprise SSO
- Modern Authentication (FIDO, WebAuthn, Passkeys)
- Session Management
- Authentication Bypasses & Attacks
- Implementation Security
- Testing & Verification
1. Fundamentals#
Core Concepts#
| Term | Definition | Security Impact |
|---|
| Authentication (AuthN) | Process of verifying identity claims | Foundation of access control |
| Digital Identity | Unique representation in online context | Basis for authorization decisions |
| Identity Proofing | Binding digital identity to real person | KYC/compliance requirement |
| Session Management | Maintaining state across requests | Critical for web application security |
Authentication Factors#
| Factor Type | Examples | Vulnerability Classes |
|---|
| Something You Know | Passwords, PINs, security questions | Brute force, credential stuffing, social engineering |
| Something You Have | Hardware tokens, mobile apps, SMS | SIM swapping, device theft, malware |
| Something You Are | Biometrics (fingerprint, face, voice) | Spoofing, template theft, privacy concerns |
2. Password-Based Authentication#
Password Strength Requirements#
| Requirement | NIST SP800-63B Standard | Security Rationale |
|---|
| Minimum Length | 8 chars (with MFA), 14+ (without MFA) | Increases brute force difficulty |
| Maximum Length | At least 64 characters | Prevents artificial length limits |
| Character Composition | No mandatory complexity rules | Avoid predictable patterns |
| Dictionary Checking | Block common passwords | Prevent credential stuffing |
Common Password Vulnerabilities#
ATTACK VECTORS:
├── Credential Stuffing
│ ├── Breach databases (HaveIBeenPwned)
│ ├── Password reuse across sites
│ └── Automated login attempts
├── Brute Force Attacks
│ ├── Dictionary attacks
│ ├── Rule-based mutations
│ └── Hybrid attacks
└── Password Reset Flows
├── Weak reset tokens
├── Token reuse vulnerabilities
└── Account enumeration
Secure Implementation Patterns#
| Security Control | Implementation | Bypass Techniques |
|---|
| Rate Limiting | Progressive delays, account lockouts | IP rotation, distributed attacks |
| CAPTCHA | Human verification challenges | OCR bypass, solving services |
| Password Hashing | bcrypt, scrypt, Argon2 | Rainbow tables (if salts weak) |
| Breach Detection | Monitor for credential exposure | Private/corporate breaches |
3. Multi-Factor Authentication (MFA)#
MFA Implementation Types#
| Method | Security Level | User Experience | Attack Vectors |
|---|
| SMS OTP | Low | High friction | SIM swapping, SS7 attacks |
| TOTP Apps | Medium | Medium friction | Device compromise, social engineering |
| Push Notifications | Medium-High | Low friction | MFA fatigue, device takeover |
| Hardware Tokens | High | Medium friction | Physical theft, supply chain |
| Biometrics | High | Low friction | Spoofing, template extraction |
MFA Bypass Techniques#
BYPASS METHODS:
├── Social Engineering
│ ├── MFA fatigue (push spam)
│ ├── Vishing (voice phishing)
│ └── SIM swapping
├── Technical Bypasses
│ ├── Session fixation
│ ├── MFA enrollment abuse
│ ├── Backup code exploitation
│ └── Race conditions
└── Adversary-in-the-Middle
├── Real-time phishing (Evilginx)
├── Session hijacking
└── Token replay
Implementation Security Checklist#
| Control | Verification | Common Mistakes |
|---|
| Enrollment Security | Verify primary auth before MFA setup | Allow MFA changes without re-auth |
| Backup Mechanisms | Secure recovery codes | Weak backup code generation |
| Device Trust | Risk-based authentication | Unlimited device trust |
| Rate Limiting | Throttle MFA attempts | No limits on failed attempts |
4. OAuth 2.0 & OpenID Connect#
OAuth 2.0 Flow Types#
| Grant Type | Use Case | Security Considerations |
|---|
| Authorization Code | Server-side web apps | Most secure, requires PKCE for SPAs |
| Implicit | Legacy SPAs | Deprecated, token in URL |
| Client Credentials | Service-to-service | No user context, secure storage critical |
| Device Code | IoT/limited input devices | Phishing risk during user approval |
Common OAuth Vulnerabilities#
| Vulnerability | Attack Vector | Mitigation |
|---|
| Authorization Code Interception | Redirect URI manipulation | Strict redirect validation |
| State Parameter Missing | CSRF attacks | Cryptographically strong state |
| Scope Escalation | Privilege elevation | Minimal scope principle |
| Client Impersonation | Stolen client credentials | Client authentication |
OAuth Security Implementation#
SECURITY CONTROLS:
├── Authorization Server
│ ├── Strict redirect URI validation
│ ├── State parameter enforcement
│ ├── PKCE for public clients
│ └── Short-lived authorization codes
├── Resource Server
│ ├── Token introspection
│ ├── Scope validation
│ ├── Audience verification
│ └── Rate limiting
└── Client Application
├── Secure token storage
├── Token refresh handling
├── CSRF protection
└── TLS everywhere
5. SAML & Enterprise SSO#
SAML Attack Surface#
| Component | Attack Vectors | Security Controls |
|---|
| Identity Provider (IdP) | XML signature bypass, SAML injection | Strong XML validation, signature verification |
| Service Provider (SP) | Assertion replay, audience restriction bypass | Strict temporal/audience checks |
| SAML Assertions | XXE, signature wrapping | Secure XML parsing, validation |
| Metadata | Metadata spoofing, certificate substitution | Out-of-band verification |
SAML Exploitation Techniques#
ATTACK CHAINS:
├── XML Signature Bypasses
│ ├── Signature wrapping attacks
│ ├── XML comment injection
│ └── Signature exclusion
├── Assertion Manipulation
│ ├── Attribute modification
│ ├── Subject confirmation bypass
│ └── Audience restriction removal
└── Protocol-Level Attacks
├── Replay attacks
├── SAML injection
└── Golden SAML (if signing cert compromised)
6. Modern Authentication (FIDO, WebAuthn, Passkeys)#
FIDO2/WebAuthn Architecture#
| Component | Function | Security Properties |
|---|
| Authenticator | Private key storage, user verification | Hardware-backed, phishing-resistant |
| Client (Browser) | Protocol handling, user interaction | Sandboxed execution |
| Relying Party | Credential management, verification | Challenge-response validation |
| FIDO Server | Registration/authentication logic | Cryptographic verification |
WebAuthn Security Benefits#
| Protection | Traditional Auth | WebAuthn |
|---|
| Phishing Resistance | ❌ (credentials reusable) | ✅ (origin binding) |
| Credential Theft | ❌ (server breaches expose passwords) | ✅ (public key cryptography) |
| Replay Attacks | ❌ (static credentials) | ✅ (cryptographic challenges) |
| Man-in-the-Middle | ❌ (credentials interceptable) | ✅ (origin verification) |
Implementation Considerations#
WEBAUTHN SECURITY MODEL:
├── Registration Flow
│ ├── Challenge uniqueness
│ ├── Origin verification
│ ├── User verification requirements
│ └── Attestation validation
├── Authentication Flow
│ ├── Challenge freshness
│ ├── Signature verification
│ ├── Counter validation
│ └── User presence/verification
└── Credential Management
├── Secure storage
├── Backup strategies
├── Device lifecycle
└── Recovery mechanisms
7. Session Management#
Session Security Requirements#
| Property | Implementation | Attack Prevention |
|---|
| Uniqueness | Cryptographically random IDs | Session prediction |
| Unpredictability | High entropy (128+ bits) | Brute force guessing |
| Secure Transmission | HTTPS only, Secure flag | Network interception |
| Proper Expiration | Absolute/idle timeouts | Session hijacking |
Session Attack Vectors#
SESSION ATTACKS:
├── Session Hijacking
│ ├── Network sniffing
│ ├── Cross-site scripting (XSS)
│ └── Malware/browser compromise
├── Session Fixation
│ ├── Pre-authentication session reuse
│ ├── URL-based session ID
│ └── Missing session regeneration
└── Session Timing
├── Concurrent sessions
├── Logout handling
└── Session timeout bypass
8. Authentication Bypasses & Attacks#
Business Logic Bypasses#
| Bypass Type | Technique | Testing Approach |
|---|
| Direct Access | URL manipulation | Forced browsing, parameter tampering |
| State Manipulation | Session/workflow bypass | Multi-step process analysis |
| Role Confusion | Privilege escalation | Horizontal/vertical privesc testing |
| Reset Abuse | Account takeover | Password reset flow analysis |
Technical Bypasses#
COMMON BYPASS PATTERNS:
├── Authentication Logic Flaws
│ ├── Boolean bypass (admin=true)
│ ├── SQL injection in auth queries
│ ├── LDAP injection
│ └── Authentication timing attacks
├── Protocol-Specific Issues
│ ├── JWT manipulation (alg=none)
│ ├── OAuth state bypass
│ ├── SAML signature bypass
│ └── Kerberos attacks (Golden/Silver tickets)
└── Implementation Weaknesses
├── Default credentials
├── Weak password policies
├── Missing rate limiting
└── Insecure session handling
9. Implementation Security#
Secure Coding Practices#
| Security Control | Implementation Pattern | Common Mistakes |
|---|
| Input Validation | Whitelist validation | Blacklist approaches |
| Cryptography | Industry-standard algorithms | Custom/weak crypto |
| Error Handling | Generic error messages | Information disclosure |
| Logging | Security event logging | Sensitive data in logs |
Framework-Specific Guidance#
FRAMEWORK SECURITY:
├── Spring Security
│ ├── Method-level security
│ ├── CSRF protection
│ └── Session management
├── ASP.NET Identity
│ ├── Identity configuration
│ ├── Cookie authentication
│ └── External providers
└── Express.js/Passport
├── Strategy configuration
├── Session security
└── Middleware order
10. Testing & Verification#
Authentication Testing Methodology#
| Phase | Focus Areas | Tools/Techniques |
|---|
| Reconnaissance | Authentication mechanisms | Manual analysis, Burp Suite |
| Enumeration | User accounts, endpoints | Username enumeration, timing attacks |
| Attack Execution | Credential attacks, bypasses | Hydra, custom scripts |
| Post-Exploitation | Session security, privilege escalation | Manual testing, token analysis |
TESTING ARSENAL:
├── Credential Attacks
│ ├── Hydra (brute force)
│ ├── Medusa (parallel login)
│ └── Patator (modular brute forcer)
├── OAuth/JWT Testing
│ ├── jwt_tool (JWT manipulation)
│ ├── oauth2-proxy (OAuth testing)
│ └── Burp JWT Editor
└── SAML Testing
├── SAML Raider (Burp extension)
├── SAMLReq (CLI tool)
└── Manual XML manipulation
Security Assessment Checklist#
| Category | Verification Points | Risk Level |
|---|
| Password Security | Strength requirements, storage, reset flows | High |
| Multi-Factor Auth | Implementation, bypass resistance | Critical |
| Session Management | Generation, transmission, expiration | High |
| Protocol Security | OAuth, SAML, WebAuthn compliance | Critical |
| Business Logic | Authentication flows, error handling | Medium |
Key Takeaways#
- Defense in Depth: Combine multiple authentication factors and security controls
- Protocol Compliance: Follow established standards (NIST, OWASP, OAuth specs)
- Implementation Quality: Secure coding practices prevent logic bypasses
- Continuous Monitoring: Log authentication events and monitor for anomalies
- User Experience Balance: Security controls should not create excessive friction
This guide compiles practical authentication security knowledge from 23 research sources. Keep updated with emerging authentication technologies and attack techniques.