Authentication

# VULNERABLE: MD5 hash
import hashlib
password_hash = hashlib.md5(password.encode()).hexdigest()

# VULNERABLE: SHA256 without salt/iterations
password_hash = hashlib.sha256(password.encode()).hexdigest()

# SAFE: bcrypt
import bcrypt
password_hash = bcrypt.hashpw(password.encode(), bcrypt.gensalt(rounds=12))

# SAFE: Argon2
from argon2 import PasswordHasher
ph = PasswordHasher()
password_hash = ph.hash(password)

# WRONG: Reveals valid usernames
"User not found"
"Invalid password"
"Account locked"

# CORRECT: Generic message
"Login failed; Invalid user ID or password."

# WRONG: Reveals valid emails
"Email not found"
"Password reset email sent"

# CORRECT: Generic message
"If that email address is in our database, we will send you an email to reset your password."

# WRONG: Reveals existing accounts
"Email already registered"

# CORRECT: Generic message
"A link to activate your account has been emailed to the address provided."

# Configuration
LOCKOUT_THRESHOLD = 5  # Failed attempts before lockout
OBSERVATION_WINDOW = 15 * 60  # 15 minutes
LOCKOUT_DURATION = 30 * 60  # 30 minutes

# Implementation
class LoginAttemptTracker:
    def record_failed_attempt(self, account_id):
        # Track by account, NOT by IP
        # IP-based tracking allows bypassing via distributed attacks
        pass

    def is_locked(self, account_id):
        # Check if account is locked
        pass

    def allow_password_reset_when_locked(self):
        # Prevent lockout from becoming DoS
        return True

def get_lockout_duration(failed_attempts):
    # Double duration with each lockout
    base_duration = 60  # 1 minute
    return base_duration * (2 ** (failed_attempts // LOCKOUT_THRESHOLD - 1))

# Per-IP rate limiting (defense in depth)
RATE_LIMIT = "10/minute"

# Per-account rate limiting
ACCOUNT_RATE_LIMIT = "5/minute"

// Registration
const publicKeyCredential = await navigator.credentials.create({
    publicKey: {
        challenge: serverChallenge,
        rp: { name: "Example Corp", id: "example.com" },
        user: { id: userId, name: username, displayName: displayName },
        pubKeyCredParams: [{ type: "public-key", alg: -7 }],  // ES256
        authenticatorSelection: { userVerification: "preferred" }
    }
});

# VULNERABLE: Predictable session ID
session_id = str(user_id) + str(int(time.time()))

# SAFE: Cryptographically random
import secrets
session_id = secrets.token_hex(32)  # 256 bits

Set-Cookie: session_id=abc123;
    Secure;          # HTTPS only
    HttpOnly;        # No JavaScript access
    SameSite=Lax;    # CSRF protection
    Path=/;          # Scope
    Max-Age=3600;    # Expiration

# VULNERABLE: Not regenerating session on login (Session Fixation)
def login(username, password):
    user = authenticate(username, password)
    session['user_id'] = user.id  # Same session ID - attacker can pre-set it!

# SAFE: Regenerate session ID after authentication
def login(user, password):
    if authenticate(user, password):
        # CRITICAL: Generate new session ID to prevent fixation
        session.regenerate()
        session['user_id'] = user.id

# Regenerate after privilege changes
def elevate_privileges():
    session.regenerate()
    session['is_admin'] = True

# Proper logout - invalidate both server and client
def logout():
    session.invalidate()  # Server-side invalidation
    response.delete_cookie('session_id')

# Option 1: Allow only one session per user
def login(user):
    invalidate_all_sessions(user.id)
    return create_session(user)

# Option 2: Limit concurrent sessions
MAX_SESSIONS = 3
def login(user):
    sessions = get_sessions_by_user(user.id)
    if len(sessions) >= MAX_SESSIONS:
        oldest = min(sessions, key=lambda s: s['created_at'])
        invalidate_session(oldest['id'])
    return create_session(user)

def requires_recent_auth(max_age=300):  # 5 minutes
    """Decorator requiring recent authentication."""
    def decorator(f):
        def wrapper(*args, **kwargs):
            last_auth = session.get('last_auth_time')
            if not last_auth or time.time() - last_auth > max_age:
                raise ReauthenticationRequired()
            return f(*args, **kwargs)
        return wrapper
    return decorator

@requires_recent_auth(max_age=300)
def change_password(old_password, new_password):
    pass

# Weak hashing
grep -rn "md5\|sha1\|sha256" --include="*.py" --include="*.js" | grep -i password
grep -rn "hashlib\\.md5\|hashlib\\.sha" --include="*.py"

# Predictable session IDs
grep -rn "uuid1\|time\\(\\).*session\|user.*id.*session" --include="*.py"

# Missing cookie security
grep -rn "Set-Cookie" --include="*.py" --include="*.js" | grep -v -i "secure\|httponly"

# Error message leakage
grep -rn "not found\|invalid password\|does not exist" --include="*.py" --include="*.js"

# Session handling
grep -rn "session\\.regenerate\|regenerate_id\|new_session" --include="*.py" --include="*.php"