9 lines
679 B
Markdown
9 lines
679 B
Markdown
# Authentication and authorization security
|
|
|
|
* Use established authentication standards and password hashing; never store plaintext or reversibly encrypted passwords.
|
|
* Enforce authorization server-side for every sensitive operation and verify resource ownership and tenant boundaries.
|
|
* Use least-privilege roles, short-lived sessions or tokens where supported, and invalidate credentials after sensitive account changes.
|
|
* Validate token issuer, audience, signature, and expiry before trusting claims.
|
|
* Protect authentication and privileged actions against brute force and privilege escalation.
|
|
* Test unauthenticated, unauthorized, cross-user, and cross-tenant access paths.
|