Harden Sessions and Authentication

Task

Review the authentication boundary for predictable failure behavior and production-minded defaults.

Confirm that:

• session cookies are HTTP-only
• cookies use secure in production
• sameSite is appropriate
• expired sessions are rejected
• session refresh does not extend invalid sessions
• logout invalidates the server-side session
• passwords are never returned by API responses

Keep authentication failures generic where revealing account existence would be useful to an attacker.

If you have an in-memory rate limiter for authentication attempts, keep in mind that it is appropriate for a single-process development setup but is not a durable multi-instance production limiter.

Test

Verify:

• repeated invalid logins are limited according to the application’s configured policy
• expired sessions cannot access protected resources
• logout invalidates the session
• password hashes never appear in network responses

Checkpoint

The authentication boundary has explicit security expectations and predictable failure behavior.