audit-auth

To audit JWT validation code, scan for specific weaknesses like accepting alg=none, missing issuer/audience/expiration validation, and unsafe key confusion patterns. The review generates a CWE-mapped evidence report with exact source file line ranges for each concrete issue found.

Common session fixation vulnerabilities include session predictability, missing secure cookie attributes, and cases where sessions are not rotated appropriately after login. Scanning the source code for these patterns produces a report detailing each flaw with a CWE ID and severity level.

To check OAuth redirect and callback flows, review the source code for missing state parameter validation, unsafe redirect handling, and flawed route-level authorization checks. The audit flags these issues and persists each finding with a CWE ID, severity, and exact source line range.

Yes, you can scan source code to identify plaintext or weak password storage and login rate-limit gaps. The review targets password workflows and route authorization, persisting concrete findings with CWE IDs, severity levels, and exact source file line ranges.

The best way to map CWE IDs to authentication findings is to perform a source-aware review of login, session, and token code paths. The process persists each concrete vulnerability with a CWE ID, severity, and exact source file line range via a structured reporting mechanism.

Yes, the authentication audit applies directly to source-aware review of token verifiers, middleware, and callback redirect handling. It scans these specific code paths for security patterns and generates a report with CWE IDs, severities, and exact line ranges for each issue.