Auth Failures

This is a homecoming for anyone who did the Authentication & Session Security course — A07 is that entire course's subject, compressed into one Top 10 slot. So this chapter's job is the map: what the category spans, why it ranks where it does, and where each piece links back to the depth you already have.

A07: Identification & Authentication Failures

This category covers failures in confirming a user's identity and managing their session securely — everything from weak passwords to broken session handling to flawed account recovery. Note the deliberate naming: it was previously "Broken Authentication," renamed in 2021 to also emphasize identification (establishing who someone claims to be) alongside authentication (proving it). It dropped from #2 to #7 — not because it's less serious, but because frameworks and managed identity providers now handle a lot of it correctly out of the box.

What the Category Spans (and Where It's Covered)

In other words: A07 ≈ the whole Auth course. Rather than re-teach it, this chapter pulls out the through-line that ties all those failures together.

The Unifying Idea: Protect One Secret Across Its Life

The Highest-Leverage Defences

If A07 is the Auth course condensed, here are the controls that matter most — in rough order of impact:

1. Multi-factor authentication — the single highest-leverage control; a guessed or stuffed password alone is no longer enough (Auth Ch. 6).
2. Strong password storage — slow, salted hashes (Argon2id/bcrypt), never fast hashes or "encryption" (Auth Ch. 2; also A02).
3. Defend the login — rate limiting (IP + account), breach-password checks, generic responses + uniform timing (no enumeration) (Auth Ch. 3).
4. Secure sessions — high-entropy IDs, regenerate at login (anti-fixation), idle + absolute timeouts, server-side logout, HttpOnly/Secure/SameSite cookies (Auth Ch. 4–5).
5. Secure recovery — single-use, expiring, hashed reset tokens; re-authenticate sensitive changes; no security questions (Auth Ch. 9).
6. Don't roll your own — use vetted auth libraries / managed identity providers (which is largely why A07's rank fell).

Identification vs Authentication — the Rename's Point

The 2021 addition of "Identification" highlights a subtle layer: identification is the claim ("I'm user philip"), authentication is the proof (the password/passkey checks out). Failures can occur at the identification layer too — e.g. allowing account enumeration (confirming which identities exist), weak identity proofing during registration, or letting one identity be confused with another. Getting identity right is the precondition for getting authentication right.

Hands-On Exercises