Authentication confirms that a user is who they claim to be. The cheat sheet below condenses the OWASP best-practice guidance into a quick reference.
| Topic | Key points |
|---|---|
| User IDs | Treat identifiers as case-insensitive and unique; use email addresses with care. |
| Password strength | Require a sensible minimum length, allow long passphrases, and avoid arbitrary composition rules. |
| Breached passwords | Check new passwords against known-breached lists and reject matches. |
| Secure storage | Hash passwords with a strong, salted, adaptive algorithm such as bcrypt or Argon2. |
| Password recovery | Use time-limited, single-use tokens; never email passwords or reveal whether an account exists. |
| Secure transmission | Send credentials only over TLS. |
| Generic error messages | Return identical messages for invalid usernames and passwords to prevent account enumeration. |
| Re-authentication | Require the current password before changing passwords or performing sensitive actions. |
| Multi-factor authentication | Offer and encourage MFA, especially for privileged accounts. |
| Protect against automation | Apply rate limiting, lockouts and CAPTCHA to resist brute-force attacks. |
Ready to strengthen your security?
Talk to our consultants about your penetration testing requirements, or get a fast, transparent quote.