After auditing authentication implementations across dozens of production systems, the same gaps appear repeatedly. This is the checklist I run against every authentication implementation before declaring it production-ready.
Password storage: bcrypt, Argon2, or scrypt with appropriate cost factors. Never MD5, SHA1, or unsalted SHA256. Never plain text.
Session management: session IDs must be cryptographically random (at least 128 bits), regenerated on login to prevent session fixation, invalidated on logout (server-side, not just cookie deletion), and expired after a reasonable idle period.
Brute force protection: rate limiting on authentication endpoints, account lockout after configurable failed attempts, and CAPTCHA for high-risk authentication flows.
Multi-factor authentication: TOTP (Time-based One-Time Password) at minimum. Implement it before you need it — retrofitting MFA to an existing authentication system is more complex than building it in.
Credential breach monitoring: check new passwords against Have I Been Pwned's database. A password that has been in a breach is a compromised password regardless of its complexity.
— Dick Bassey | DevDick | 2023