152-knowledge_base--Access_control_pattern--.md

Access-control/Login systems - pattern

Description:

For successful access control/login functionality there are a lot of things to take into consideration before you start developing this type of functionality.

Solution:

It is highly recommended to study all the listed items and implement these principles in your access control/login system in order to enforce a higher level of security.

1. Audit logs
2. Principle of least privilege (Privilege based authentication system)
3. Passwords must be encrypted, salted and stretched
4. Cross-Site Request Forgery (CSRF for authenticated forms)
5. Session pattern
6. Session fixation
7. Session hijacking
8. Forget password functions
9. Client side authentication
10. Client side state management
11. cross sub domain cookie attack