A07 — Identification & Authentication Failures Secure

These secure demos show Rate limiting, Session fixation defenses, Reset tokens, MFA (TOTP-style), and Remember-me with selector/validator.

Attack 1 Attack 2 Attack 3 Attack 4 Attack 5

Uses shared DB tables (a07_*). Seed data in db/seed.sql. Compare with the Insecure version.

Attack 1 — Brute-force / Rate Limiting

per-user/IP window + backoff

Secure idea: Track attempts per user and IP in a sliding window, add backoff/jitter, and log for alerting. Responses remain uniform. "alice@example.com/alice@example.com"

  1. Enter email/password; repeated failures begin throttling.
  2. On success, counters reset and you’re logged in.

Attack 2 — Session Fixation & Cookie Flags

session_regenerate_id + HttpOnly/Secure/SameSite

Secure idea: on login, session_regenerate_id(true) to kill fixation. Set cookies with HttpOnly, Secure, and SameSite=Lax/Strict.

  1. Click Begin to see your pre-login SID.
  2. Log in (secure) — SID should change.
  3. Open Who am I to inspect current SID & cookie attributes.
Begin (pre-login SID)
Who am I?

Attack 3 — Password Reset Tokens

random token + hash + TTL + one-time

Secure idea: 32-byte random token → store the hash with short TTL, single-use.

  1. Request a reset link for an email.
  2. Paste the returned URL to perform a secure reset.

Attack 4 — MFA (TOTP-style)

HMAC code + time window + nonce

Secure idea: Require time-based one-time code from per-user secret, verify in small window, and track a one-time challenge nonce.

  1. Begin MFA (server issues challenge + shows demo secret).
  2. Enter current 6-digit code to verify.
Begin MFA (secure)

Attack 5 — Remember-Me (Persistent Login)

selector + validator (hash in DB) + rotate

Secure idea: Split cookie into selector (id) + validator (secret). Store only the hash of the validator with expiry; rotate on use; mismatch ⇒ invalidate.

  1. Set a secure remember-me cookie.
  2. Validate it (simulated returning visit).
  3. Clear it when done.
Set Remember-Me (secure)
Validate Remember-Me Clear