<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: implementing-secure-authentication-flows
description: >-
  Build secure authentication with proper password hashing, MFA, and session management.
domain: cybersecurity
subdomain: secure-coding
tags:
  - authentication
  - password-hashing
  - mfa
  - secure-coding
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1078"]
---

# Implementing Secure Authentication Flows

## Overview

Build secure authentication with proper password hashing, MFA, and session management.

## Prerequisites

| Requirement | Install |
|---|---|
| bcrypt/argon2 | `pip install bcrypt argon2-cffi` |
| pyotp | `pip install pyotp` |
| Python 3.10+ | For agent tooling |

## Key Concepts

Secure auth requires argon2id/bcrypt hashing, MFA, secure tokens,
account lockout, and rate limiting. Never store plaintext passwords.

## Quick Reference

```bash
import argon2; ph = argon2.PasswordHasher()
node agent.js audit --file auth.py --checks password-hash,mfa
node agent.js generate --component auth --features hash,mfa
node agent.js test --url https://target.com/auth
```

## Workflow

1. Implement argon2id
2. Account lockout
3. TOTP MFA
4. Secure session tokens
5. Rate limiting
6. Secure reset
7. Audit OWASP

## Detection

```yaml
title: Secure Authentication Flows Detection
id: d5424f0d-2121-4d41-991f-8af949fa7682
status: experimental
description: Detects suspicious activity related to implementing secure authentication flows techniques in secure coding context
logsource:
  category: application
  product: webserver
detection:
  selection:
    EventType: error
  condition: selection
level: medium
tags:
  - attack.t1078
  - attack.initial_access
falsepositives:
  - Static analysis tools scanning source code repositories
```

## Verification

- Verify argon2id/bcrypt
- Confirm lockout
- Validate MFA
- Check token entropy
- Verify rate limiting

## References

- OWASP Testing Guide — https://owasp.org/www-project-web-security-testing-guide/
- MITRE ATT&CK — https://attack.mitre.org/
- NIST SP 800-53 — https://csf.tools/reference/nist-sp-800-53/
