Sign-in flows and common attacks
🏠The everyday picture
A building's security isn't just a good lock: it's a guard who notices someone trying every key, a visitor log, and a safe process for replacing lost keys.
📘What it really is
A secure sign-in flow:
-
Same message for wrong email or wrong password: "Email or password is incorrect". Saying "no such user" tells attackers which emails have accounts.
-
Rate-limit attempts per account and per IP address, with increasing delays (Module 48). This stops brute-force and credential-stuffing attacks (trying leaked passwords from other sites).
-
Password reset:
- send a single-use, random link that expires within an hour;
- store only a hash of the reset token;
- always reply "If that email is registered, we've sent a link", whether or not it exists;
-
end all existing sessions after a reset.
-
Session safety: new session id at sign-in, expiry after inactivity, sign-out everywhere option.
- HTTPS everywhere (Module 6), so passwords and cookies aren't readable in transit.
- Log sign-ins, failures and resets (without passwords) to spot attacks (Module 45).
-
CSRF (cross-site request forgery): another site tricks a signed-in browser into sending a request.
SameSitecookies help; for extra protection, require a CSRF token or a custom header on changing requests. -
Never log or send passwords, not even in error messages or analytics.
🖱️Try it
Update your sign-in to use the same message for both failures, add a simple counter that blocks an email for 15
minutes after 5 failed attempts, and log each failure (with email and time, never the password). Connect the React
app's login page from Module 36 to the real API, sending credentials: "include", and protect the dashboard using
/me.
✅Quick check
Why say "Email or password is incorrect" instead of "No account with that email"?
Show the answer
So attackers can't discover which emails have accounts.
What's credential stuffing, and what helps against it?
Show the answer
Trying usernames and passwords leaked from other sites; rate limiting, MFA and checking for leaked passwords help.