Broken Authentication

Broken Authentication generally refers to weakness in 2 areas - 1) Session Management and 2 ) Credential management

Primary reasons for broken authentication are poor credential management ( weak passwords, weak cryptography) and poor session management

How to prevent Broken Authentication

1) Use Stronger Password

2) Implement MFA

3) Create a profile for failed login attempts which would lock the account after some specified number of failed login attempts

4) Don't use Session IDs in URLs

5) Rotate and invalidate Session IDs

6) Programatically, control session length to the type of user and application they are using