The newest Authentication resources are on the Authentication page. For a reading order instead of a date order, see the Authentication learning path.
| Date Added | Link | Excerpt |
|---|---|---|
| 2026-04-10 2026 | OWASP: Session Fixation Protection beginner 3 min read | Reference outlining a technique for protecting against session fixation attacks in classic ASP. The method involves using a secondary cookie, named "ASPFIXATION," to store a random value that is synchronized with a session variable. When the values do not match, indicating a potential attack, the user is redirected to the login page. The implementation uses a `RandomString` function for generating random values and `AntiFixationInit` and `AntiFixationVerify` subroutines for initializing and verifying the cookie and session values, respectively. → owasp.org |
| 2026-04-10 2026 | OWASP: Session fixation attack beginner 3 min read | Reference on Session Fixation attacks, a vulnerability where an attacker hijacks a valid user session by tricking the user into authenticating with a pre-determined session ID. The article details techniques such as embedding session tokens in URLs, hidden form fields, cookies via client-side scripting (like XSS) or META tags, and manipulating HTTP response headers with `Set-Cookie`. It contrasts this with session hijacking, emphasizing that fixation occurs before user login. → owasp.org |
| 2026-04-10 2026 | OWASP Top 10 A07: Identification and Authentication Failures beginner 2 min read | Reference on OWASP Top 10 A07: Identification and Authentication Failures, this entry details risks including credential stuffing, brute force, weak passwords, and improper session management. Prevention strategies emphasize multi-factor authentication, avoiding default credentials, implementing strong password policies aligned with NIST 800-63b, hardening against account enumeration, and secure session handling. Attack scenarios illustrate vulnerabilities like exposed session identifiers and insufficient logout invalidation. → owasp.org |
| 2026-04-10 2026 | OWASP Session Management Cheat Sheet beginner 33 min read | Reference for OWASP Session Management covering secure generation of session IDs with sufficient entropy (at least 64 bits) and appropriate length to prevent brute-force guessing attacks. It also details avoiding predictable session ID content that could lead to information disclosure and recommends generic session ID names to prevent fingerprinting of web application technologies like PHP, J2EE, and ASP.NET. → cheatsheetseries.owasp.org |
| 2026-04-10 2026 | OWASP Authentication Cheat Sheet beginner 22 min read | Cheatsheet detailing secure authentication practices, covering user ID generation, username policies, password strength enforcement (including length and character set recommendations, blocking breached passwords via services like Pwned Passwords, and utilizing libraries like zxcvbn-ts), secure password storage and comparison, password recovery mechanisms, and the imperative of transmitting credentials exclusively over TLS. It also emphasizes re-authentication for sensitive actions to prevent CSRF and session hijacking. → cheatsheetseries.owasp.org |
| 2026-04-10 2026 | The Fragile Lock: Novel Bypasses for SAML Authentication | PortSwigger Research advanced 13 min read | Tool for bypassing SAML authentication, this library exploits parser-level inconsistencies in the Ruby and PHP SAML ecosystems. Novel techniques, including attribute pollution, namespace confusion, and Void Canonicalization attacks, enable attackers to bypass XML Signature validation while presenting valid SAML documents to applications. The toolkit aids in identifying discrepancies between XML parsers, facilitating the discovery of authentication bypasses with minimal requirements. → portswigger.net |
| 2026-04-10 2026 | PortSwigger: OAuth 2.0 authentication vulnerabilities intermediate 18 min read | Reference detailing OAuth 2.0 authentication vulnerabilities, explaining how this framework, commonly used for social media logins, is prone to implementation mistakes. The content covers how attackers can exploit these flaws to gain access to sensitive user data or bypass authentication, with a focus on the authorization code and implicit grant types. It also touches upon vulnerabilities within the OpenID Connect extension and provides guidance for mitigating these risks. → portswigger.net |
| 2026-04-03 2026 | Authn vs. authz: How are they different? beginner AuthZ | Authentication (authn) refers to identity, while authorization (authz) has to do with permissions. Learn about the difference between authn vs. authz in more detail. |
| 2026-01-31 2026 | Authentication Fundamentals: Part I beginner 5 min read | Library covering fundamental authentication techniques, including password-based systems, HTTP Basic Access Authentication, session-cookie management, token-based approaches, API keys, One-Time Passwords (OTP), Time-Based One-Time Passwords (TOTP), and federated identity with Single Sign-On (SSO). It details the mechanisms, pros, and cons of each, referencing the 23AndMe breach as an example of password reuse vulnerability. |
| 2026-01-27 2026 | Hunting Account Takeovers in the Wild West of MCP OAuth Servers" advanced 6 min read AI | Library for discovering and exploiting misconfigured OAuth implementations in MCP (Model Context Protocol) servers, commonly used to connect AI assistants like ChatGPT and Claude to third-party services. The library identifies vulnerabilities arising from open Dynamic Client Registration (DCR), missing redirect URI validation, and optional PKCE enforcement, which collectively enable one-click account takeover attacks where attackers can register malicious clients, craft deceptive authorization URLs, and intercept tokens without robust authentication. |
| 2026-01-21 2026 | OAuth 2.0 Course for Beginners beginner AuthZ | Course on OAuth 2.0 for beginners, detailing the authorization framework and its four roles: Resource Owner, Client, Auth Server, and Resource Server. It covers the importance of PKCE, project setup, building authorization and resource servers, and the client app using Authorization Code flow with PKCE. Debugging common errors like JWKS and Axios 400 issues, along with best practices and repository setup, are also included. |
| 2025-10-27 2025 | Stealing Microsoft Teams access tokens in 2025 intermediate 3 min read JWT | Writeup detailing how to extract Microsoft Teams access tokens by targeting the `msedgewebview2.exe` process, which writes encrypted cookies containing DPAPI-protected keys to a local state file. The technique leverages Sysinternals ProcMon to locate cookie writes, analyzes the `Cookies` database for encrypted values, and uses the DPAPI key to decrypt them with AES-256-GCM, similar to methods described for Chromium. The extracted tokens can then be used to interact with Microsoft Graph API endpoints or with post-exploitation tools like GraphSpy for actions such as reading or sending messages. |
| 2025-10-22 2025 | Beyond credentials: weaponizing OAuth applications for persistent cloud access | Proofpoint US advanced 7 min read AuthZ | Tool for automating the creation of malicious internal OAuth applications, enabling persistent cloud access even after credential resets or MFA enforcement. Proofpoint researchers developed this tool to demonstrate how threat actors can hijack user accounts by registering second-party applications, configuring custom scopes, and authorizing them to access critical resources, thus bypassing traditional security measures and evading detection. |
| 2025-09-29 2025 | Using Google Login With Flask intermediate | Library for integrating Google OAuth 2 and OpenID Connect into Flask applications, enabling users to log in with their Google identity instead of creating new accounts. This course guides you through building a Flask web application, managing user sessions with Flask-Login, and understanding the underlying OAuth 2 and OIDC protocols. → realpython.com |
| 2025-09-06 2025 | Cookie Chaos: How to bypass __Host and __Secure cookie prefixes intermediate 4 min read | Library for testing __Host and __Secure cookie prefix bypasses. It details how discrepancies between browser and server cookie parsing logic, such as UTF-8 encoding of whitespace characters (U+2000) and legacy parsing behaviors triggered by $Version=1, can allow attackers to inject high-privilege cookies from untrusted origins. Frameworks like Django and ASP.NET, and servers like Apache Tomcat and Jetty, are noted as potentially vulnerable. A Burp Suite Custom Action is provided to detect these conditions. → portswigger.net |
| 2025-09-05 2025 | Better Auth: The Game‑Changer JS Authentication Has Been Waiting For | daily.dev intermediate | Library for framework-agnostic JavaScript authentication, Better Auth, operates within your application and stores user data in your own database. It integrates email/password, social SSO, 2FA, passkeys, and multi-session support via a plugin system. This approach bypasses per-user costs and vendor lock-in, granting complete control over authentication, and is compatible with Next.js, Remix, Nuxt, and SvelteKit. |
| 2025-09-05 2025 | Authentication Explained: When to Use Basic, Bearer, OAuth2, JWT & SSO | daily.dev beginner AuthZ JWT | Reference explaining authentication and authorization models, detailing RBAC, ABAC, and ACL as primary authorization methods. It highlights OAuth2 for delegated access, and JWTs/bearer tokens for carrying identity and permissions. The entry emphasizes selecting the appropriate combination of these mechanisms based on application complexity and security needs, citing real-world examples like GitHub and Stripe. |
| 2025-08-06 2025 | ByteByteGo | OAuth 2.0 Explained With Simple Terms beginner | Library explaining OAuth 2.0, a secure framework enabling applications to interact on behalf of users without sharing credentials. It details entities like the User, Server, and Identity Provider (IDP), and how OAuth tokens facilitate Single Sign-On (SSO) and authorization across systems, allowing controlled access to user profile information. |
| 2025-06-09 2025 | Understanding Mutual TLS (MTLS) Authentication: How It Works beginner | Learn how mutual TLS (mTLS) works by exchanging and verifying digital certificates between client and server for data transmission in a network. |
| 2025-05-07 2025 | Using JWTs in Python Flask REST Framework | AppSignal Blog intermediate 8 min read API Sec Python | Library for building JWT-authenticated REST APIs in Python Flask. It explains JWT components (header, payload, signature) and their security benefits like stateless sessions and integrity verification. The guide demonstrates implementing user registration, login with token issuance, and securing endpoints using `@jwt_required()` and `get_jwt_identity()` via the `Flask-JWT-Extended` library. It also covers CRUD operations for a to-do list API and how to manage token expiration and refreshes for extended user sessions. |
| 2025-05-03 2025 | Fortress Login Pro – Secure, Hide & Rename Login URL intermediate 3 min read | Library for WordPress security that hides and rotates the login URL, preventing brute-force attacks. It offers features like custom login paths, auto-rotating slugs with a dual-slug fail-safe, access logging with IP and user-agent tracking, and an optional `.htaccess` toggle for blocking direct access to installation files. The library is compatible with popular WordPress plugins like WooCommerce and security tools such as Wordfence. |
| 2025-02-23 2025 | GitHub - goauthentik/authentik: The authentication glue you need. beginner | Library for open-source Identity Provider (IdP) functionality, supporting SAML, OAuth2/OIDC, LDAP, and RADIUS. It's designed for self-hosting and can replace enterprise solutions like Okta, Auth0, Entra ID, and Ping Identity. Deployment options include Docker Compose, Kubernetes via Helm chart, AWS CloudFormation, and DigitalOcean Marketplace for scalable identity management. The project also offers developer documentation for local setup and contributions, along with a SECURITY.md file. |
| 2025-02-10 2025 | GitHub - steveiliop56/tinyauth: The simplest way to protect your apps with a login screen. beginner 2 min read | Library for authentication and authorization, Tinyauth offers OAuth, LDAP, and access-control support as middleware or a standalone server. It integrates with proxies like Traefik, Nginx, and Caddy. Documentation, guides, and a demonstration `docker-compose` file are available, showcasing its capabilities with Traefik and Whoami. A demo login uses "user" / "password". |
| 2024-12-22 2024 | The long and winding road to safe browser-based cryptography advanced 7 min read | Library for securing browser-based cryptography, addressing the critical problem of untrusted JavaScript delivery by compromised servers. It reviews existing attempts like Subresource Integrity and the Web Crypto API, highlighting their limitations. Case studies of attacks on MyEtherWallet and the implications of court orders for encrypted email providers Tuta and Proton illustrate the risks. The library focuses on integrity validation for web applications within the browser, aiming to provide users with assurance that the code they execute is legitimate, drawing inspiration from efforts like Meta's Code Verify and the WAIT prototype. |
| 2024-12-10 2024 | Sign in with Azure CLI using a service principal intermediate 1 min read | Reference for authenticating with Azure CLI using service principals, detailing the requirements for signing in via client secrets or X509 certificates. It includes command examples for both `az login` with a client secret and certificate-based authentication, and provides methods for securely handling credentials in Bash and PowerShell scripts, emphasizing the use of `read -s` and `Get-Credential`. |
| 2024-11-26 2024 | The OAuth Oversight: When Configuration Errors Turn into Account Hijacks intermediate API Sec | Hey folks I hope you are doing well. I am back with another writeup on OAuth misconfiguration leads to account takeover. The PoC is… |
| 2024-10-22 2024 | An Illustrated Guide to OAuth and OpenID Connect beginner 6 min read | Reference explaining OAuth 2.0 authorization and OpenID Connect (OIDC) authentication. It details the authorization code flow, client IDs and secrets, scopes, consent forms, and the use of Access Tokens and ID Tokens (JWTs) for identity information, facilitating single sign-on scenarios across applications. |
| 2024-10-15 2024 | Using Flask-Login for User Management with Flask – Real Python beginner 4 min read | Learning Path that guides Python developers through building complete Flask applications, covering foundational skills in HTML, CSS, and Jinja templating. It progresses to creating scalable Flask web applications with databases, developing REST APIs using Flask, Connexion, and SQLAlchemy, and integrating JavaScript front ends. The path also includes tutorials on adding logging and notification messages, and deploying Flask applications to the web using Heroku. → realpython.com |
| 2024-10-03 2024 | Automate your API hacking with Autorize intermediate 6 min read API Sec AuthZ | Library for automatically detecting broken object level authorization (BOLA) and other access control issues in APIs. Autorize, a Burp Suite extension, simplifies authorization testing by repeatedly sending requests with modified header values representing low-privileged, high-privileged, and unauthenticated users. It then analyzes response differences to identify potential vulnerabilities, offering configurable filters and integration with Burp's Repeater. → danaepp.com |
| 2024-09-30 2024 | Broken Authentication: A Common Vulnerability Exposing User Accounts beginner | Exploiting Weak Authentication Mechanisms to Compromise User Access → cyberw1ng.medium.com |
| 2024-09-22 2024 | GitHub - azukaar/Cosmos-Server: ☁️ The Most Secure and Easy Selfhosted Home Server. Take control of your data and privacy without sacrificing security and stability (Authentication, anti-DDOS, anti-bot) beginner 10 min read | Library for self-hosting home servers that secures applications with features like SmartShield technology for dynamic rate limiting, adaptive actions, user bans, and global request control. It offers an app store, storage management, reverse proxy with automatic HTTPS, multi-factor authentication via OpenID, and built-in anti-bot and anti-DDOS protections. SDKs for JavaScript/TypeScript and Go, along with a Terraform provider, are available for programmatic access and automation. |
| 2024-09-14 2024 | Unlocking OAuth Security intermediate API Sec | In this blog, we will uncover the different oauth security implications on both the client applications and the oauth server. → infosecwriteups.com |
| 2024-09-06 2024 | Discover Flask, Part 2 – Creating a Login Page – Real Python beginner 4 min read | Learning Path: This resource guides Python developers through building Flask web applications, covering foundational HTML, CSS, and Jinja templating. It progresses to creating scalable applications, adding logging, integrating databases with SQLAlchemy, and developing REST APIs using Flask and Connexion, with a specific mention of testing via Swagger UI. The path also includes frontend integration with JavaScript and deployment using Heroku. → realpython.com |
| 2024-09-05 2024 | JWT vs PASETO: New Era of Token-Based Authentication intermediate API Sec JWT | This article delves into a comprehensive comparison of Paseto and JWT, dissecting their core functionalities, security features, and… |
| 2024-08-28 2024 | GitHub - mkalioby/django-mfa2: A Django app that handles MFA, it supports TOTP, U2F, FIDO2 U2F (Webauthn), Email Token and Trusted Devices beginner 5 min read Python | Library for implementing multi-factor authentication (MFA) in Django applications. It supports TOTP, U2F, FIDO2 (WebAuthn), Email Tokens, and Trusted Devices, leveraging technologies like WebAuthn and Windows Hello for secure authentication. The library is configurable via `settings.py` and requires integration into Django's URL patterns and templates. |
| 2024-08-16 2024 | Securing OAuth 2.0 Token Exchange Flow with Keycloak intermediate API Sec JWT | RFC 8693: Token Exchange describes a mechanism for exchanging an existing token (JWT) for a new token with different issuing client id… |
| 2024-07-30 2024 | OAuth+XSS Attack Threatens Millions of Web Users With Account Takeover intermediate API Sec XSS | An attack flow that combines API flaws within "log in with" implementations and Web injection bugs could affect millions of websites. → darkreading.com |
| 2024-07-26 2024 | Release v0.3.0 · joaovitoriasilva/endurain news 1 min read Python | Library release v0.3.0 of Endurain introduces significant updates including OAuth scopes, multi-client support, PWA integration, theme and language switchers, and dependency bumps to Python 3.12. This release also involves crucial changes to password hashing mechanisms and database schema, requiring user intervention and backups during the update process. |
| 2023-12-16 2023 | Google OAuth is broken (sort of) intermediate 10 min read | Writeup on a Google OAuth vulnerability allowing former employees indefinite access to applications like Slack and Zoom post-offboarding. This exploit leverages the ability to create non-Gmail Google accounts using corporate email aliases and plus sign forwarding, bypassing organizational de-provisioning. Google's documentation advises against using email as an identifier, yet this flaw highlights the risks of relying on the email claim for authentication. Potential mitigations include organizations enforcing SAML, service providers utilizing the HD claim or disabling just-in-time provisioning, and Google banning specific account creation methods. → trufflesecurity.com |
| 2023-12-13 2023 | Advancing iMessage security: iMessage Contact Key Verification intermediate 9 min read | Library for iMessage Contact Key Verification, a feature that strengthens end-to-end encryption by automatically detecting sophisticated attacks against iMessage servers and allowing users to verify communication with intended recipients. This system leverages Key Transparency (KT) and a verifiable log-backed map data structure, similar to WhatsApp's Auditable Key Directory (AKD), to ensure cryptographic proofs of inclusion and consistency. User devices autonomously verify data presented by the Identity Directory Service (IDS) against the KT map, notifying users of errors if both parties have the feature enabled. |
| 2023-12-01 2023 | GitHub OAuth in your Python Flask app intermediate 3 min read | Guide on integrating GitHub OAuth into Flask applications using Supabase-py. This resource details setting up a Flask session storage for JWTs, initiating the Supabase client with PKCE flow, and creating sign-in and callback routes to manage user authentication via GitHub. |
| 2023-11-26 2023 | Unveiling the Mechanics of Session Hijacking: A Step-by-Step Guide to Capture and Exploit Cookies beginner | Unveiling the Mechanics of Session Hijacking: A Step-by-Step Guide to Capture and Exploit Cookies https://ift.tt/of3VUnE |
| 2023-11-17 2023 | doyensec/Session-Hijacking-Visual-Exploitation intermediate 3 min read | Tool for performing session hijacking by injecting malicious JavaScript. It offers interactive and visual exploitation modes, allowing users to access websites within a victim's browser context or observe their activity. The tool supports advanced exploitation via office document templates (.docm, .pptm, .xslm) to inject macros and an HTML template for exploiting CORS misconfigurations. Recommended Node.js version is 19.0.0. |
| 2023-11-17 2023 | Using Google Login With Flask (Overview) beginner | Tutorial on integrating Google Login with Flask, enabling users to authenticate using their Google identity. This approach simplifies user management, enhancing security compared to traditional username and password systems. The tutorial guides learners through creating a Flask application, setting up Google client credentials, and leveraging Flask-Login for session management, while also clarifying OAuth 2 and OpenID Connect (OIDC) concepts. → realpython.com |
| 2023-11-17 2023 | PHP and OAuth: User Authentication and Authorization beginner 9 min read | Library implementing OAuth 2.0 in PHP, detailing secure authorization flows, state management, CSRF protection, and token handling. It leverages The PHP League's OAuth 2.0 Client library, including specific providers like `league/oauth2-google`, to integrate with services such as Google's "Sign in with Google." The guide covers architecting authentication, exchanging authorization codes for access tokens, retrieving user data, and managing token refresh, with practical examples and project structure suggestions. |
| 2023-11-17 2023 | Login with Google Account using PHP beginner 6 min read | Library for integrating Google Account login into PHP web applications. It leverages the Google API PHP Client library to manage OAuth 2.0 authentication, enabling users to sign in with their Google credentials without requiring registration. The library facilitates user data storage in a MySQL database, including fields for first name, last name, email, and Google's unique identifier. Configuration involves setting up API credentials and redirect URIs within a `config.php` file, and a `User.class.php` handles database operations for user checking, insertion, and updates. |
| 2023-11-14 2023 | PHP Google OAuth Login beginner 4 min read | Tutorial on implementing Google OAuth 2.0 login in PHP applications. This guide details the process of setting up Google API credentials, integrating the PHP Google API client library, and writing code to handle authentication requests, retrieve user data, and manage user sessions. It covers creating a Google API project, obtaining client IDs and secrets, and utilizing the `Google_Client` and `Google_Service_Oauth2` classes for seamless user sign-in. |
| 2023-11-14 2023 | The PHPer's Guide to OAuth beginner 16 min read | Library for implementing OAuth in PHP applications, detailing the protocol's purpose, actors, scopes, and grant types, with a focus on the Authorization Code grant. It showcases a sample project using `league/oauth2-client` and `league/oauth2-server` to build client, authorization, and resource servers, enabling secure delegated access to APIs like Twitter, PayPal, and GitHub. |
| 2023-11-03 2023 | Burp Suite Shorts | Automatic Session Handling intermediate Burp | Burp Suite Shorts | Automatic Session Handling https://www.youtube.com/watch?v=yoENNJjC4NY&t=1s |
| 2023-11-03 2023 | Burp Suite Shorts | Automatic Session Handling intermediate Burp | Burp Suite Shorts | Automatic Session Handling https://www.youtube.com/watch?v=yoENNJjC4NY |