Authentication

Browse prompts in this category.

Prompts

Secure Account Recovery Developer
Implement password reset, email verification, and recovery flows per OWASP ASVS V2.5 with hashed single-use CSPRNG tokens, short TTLs, account lockout with backoff, enumeration-safe responses, and multi-channel identity verification. Use when building reset, lockout, or recovery endpoints.
Secure Credential Stuffing Defense Developer
Design layered credential-stuffing defenses with per-account/IP rate limits, adaptive CAPTCHA (Turnstile/reCAPTCHA v3), HIBP k-anonymity breach checks, device fingerprinting, impossible-travel velocity checks, and IP reputation scoring. Use when hardening login, registration, or password endpoints.
Secure Multi-Factor Authentication Developer
Implement MFA per NIST SP 800-63b AAL2/AAL3 with TOTP (RFC 6238), WebAuthn/FIDO2 passkeys, hashed backup codes, phishing-resistant enrollment, number-matching push, and SMS-OTP avoidance. Use when adding second factors, passkey registration, or MFA step-up challenges.
Secure Passwordless Authentication Developer
Implement passwordless auth per W3C WebAuthn Level 2 and FIDO2 — passkey registration/assertion ceremonies, origin+rpId verification, sign-counter clone detection, hashed single-use magic links, and session binding. Use when building passkey, WebAuthn, or magic-link login flows.
Secure Password Storage Developer
Implement password hashing per OWASP ASVS V2.4 and NIST SP 800-63b with Argon2id (m=19456, t=2), bcrypt cost 12+, or PBKDF2-SHA512, unique 16-byte salts, HMAC pepper, tuned work factors, timing-safe verify, and online migration. Use when storing or verifying user passwords.
Secure Session Management Developer
Design session lifecycles per OWASP ASVS V3 — 128-bit CSPRNG IDs, __Host- cookies with HttpOnly/Secure/SameSite, regeneration on auth change, idle/absolute timeouts, rotation, and revocation to stop fixation and hijacking. Use when creating, rotating, or revoking user sessions.
Secure Single Sign-On Developer
Implement SAML 2.0 SSO per NIST SP 800-63C with per-assertion signature verification (RSA-SHA256), Issuer/Audience/Destination checks, exclusive C14N, ID-based replay prevention, InResponseTo binding, and SP-initiated flow hardening. Use when integrating IdPs, SAML SPs, or federated logout.