From a96b198e23594f6a58164a77ee40b3bf718489a1 Mon Sep 17 00:00:00 2001 From: Julian Lechner Date: Thu, 24 Sep 2026 22:02:23 +0200 Subject: [PATCH] docs(security): strengthen auth guidance --- shared/rules/security/references/auth.md | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/shared/rules/security/references/auth.md b/shared/rules/security/references/auth.md index 697a8d2..be3b7fd 100644 --- a/shared/rules/security/references/auth.md +++ b/shared/rules/security/references/auth.md @@ -1,8 +1,11 @@ # Authentication and authorization security * Use established authentication standards and password hashing; never store plaintext or reversibly encrypted passwords. +* Use a maintained password-hashing scheme configured for the deployment environment. Never create password schemes or reduce work factors merely to improve latency. * Enforce authorization server-side for every sensitive operation and verify resource ownership and tenant boundaries. -* Use least-privilege roles, short-lived sessions or tokens where supported, and invalidate credentials after sensitive account changes. -* Validate token issuer, audience, signature, and expiry before trusting claims. -* Protect authentication and privileged actions against brute force and privilege escalation. -* Test unauthenticated, unauthorized, cross-user, and cross-tenant access paths. +* Deny by default and check authorization on every request, including background jobs and alternate API paths. Do not trust role or identity values supplied by clients. +* Use least-privilege roles, short-lived sessions or tokens, secure renewal and revocation, and invalidate credentials after password, recovery, or privilege changes. +* Validate token algorithm, issuer, audience, signature, expiry, and any required not-before or key identifier claims before trusting it. Reject unexpected algorithms and malformed claims. +* Protect login, recovery, reset, MFA, and privileged actions against brute force, enumeration, replay, CSRF, and privilege escalation. +* Store session identifiers securely; rotate them after authentication or privilege changes and invalidate them on logout or account recovery. +* Test unauthenticated, unauthorized, cross-user, cross-tenant, expired-token, revoked-session, and recovery-flow paths.