auth-security-validator

Authentication validation identifies insecure configurations in password hashing, cookies, and session management. It checks that password algorithms use Argon2id with sufficient parameters, cookies enforce secure, httpOnly, and sameSite flags, and sessions have secrets of at least 32 characters with finite max age settings.

OWASP-compliant password hashing requires Argon2id with memoryCost ≥ 19456 KB and timeCost ≥ 2. This ensures strong resistance against brute-force and GPU-accelerated attacks while maintaining acceptable performance for legitimate authentication flows.

Secure cookies require three attributes: the secure flag to transmit only over HTTPS, httpOnly to block JavaScript access, and sameSite set to 'lax' or 'strict' to prevent cross-site request forgery. This configuration protects against credential theft and unauthorized session access.

Secure session management enforces session secrets of at least 32 characters for unpredictability and sets finite session max age to limit exposure window. These practices align with OWASP guidance and prevent session fixation and indefinite token validity risks.

Yes, authentication security validation works as a pre-deployment check to detect compliance gaps before code reaches production. It scans auth directories and configurations to ensure all security requirements are met before release.

Detection identifies existing non-compliant configurations in your codebase, while enforcement actively requires compliance with standards. Both approaches validate against the same OWASP-aligned requirements for password hashing, cookies, and session management.