Web Application Security Fundamentals #08: Authentication & Session Management

Authentication memverifikasi siapa user. Session management memastikan siapa mereka tetap diketahui di request berikutnya. Keduanya adalah fondasi untuk authorization dan non-repudiation.

Tujuan Pembelajaran

• Memahami password storage (hashing, salt, algorithms)
• Implement secure session management
• Understand JWT (JSON Web Tokens) dan security implications
• MFA implementation dan recovery codes
• Brute force defense (rate limiting, account lockout)

Password Storage

✅ Strong Algorithms

# ✅ GOOD - Argon2id (OWASP recommended)
from argon2 import PasswordHasher
ph = PasswordHasher()
hashed = ph.hash("user_password")  # Store this
# Verify:
ph.verify(hashed, "user_password")  # Returns True/False

# ✅ GOOD - bcrypt
import bcrypt
salt = bcrypt.gensalt(rounds=12)
hashed = bcrypt.hashpw(b"password", salt)
# Verify:
bcrypt.checkpw(b"password", hashed)

# ❌ BAD - MD5, SHA1 (too fast, rainbow tables exist)
import hashlib
hashed = hashlib.md5(password).hexdigest()  # Never do this!

Session Token Generation

# ✅ SECURE - Cryptographically random
import secrets
session_id = secrets.token_urlsafe(32)  # 256-bit random

# ❌ INSECURE - Predictable
import time
session_id = str(int(time.time()))  # Guessable!

Secure Session Storage

# ✅ SECURE - HttpOnly, Secure, SameSite
@app.route('/login', methods=['POST'])
def login():
    user = authenticate(request.form['email'], request.form['password'])
    if not user:
        return 'Invalid credentials', 401
    
    session_id = secrets.token_urlsafe(32)
    # Store session server-side (database, Redis)
    Session.create(session_id, user.id, expires_in=3600)
    
    # Send HttpOnly cookie
    resp = make_response({'success': True})
    resp.set_cookie(
        '__Host-session',
        session_id,
        secure=True,          # HTTPS only
        httpOnly=True,        # JS can't access
        sameSite='Lax',       # CSRF protection
        max_age=3600
    )
    return resp

JWT (JSON Web Token) Security

# ✅ SECURE JWT usage
import jwt
from datetime import datetime, timedelta

# Generate
payload = {
    'user_id': 123,
    'exp': datetime.utcnow() + timedelta(hours=1),
    'iat': datetime.utcnow()
}
token = jwt.encode(payload, SECRET_KEY, algorithm='HS256')

# Verify
decoded = jwt.decode(token, SECRET_KEY, algorithms=['HS256'])
# If invalid or expired, exception raised

Common JWT Mistakes

# ❌ DANGEROUS - No signature verification
header, payload, sig = token.split('.')
decoded = json.loads(base64.b64decode(payload))
# Attacker can modify payload without signature check!

# ❌ DANGEROUS - Using 'none' algorithm
# JWT header: {"alg": "none"}
# Attacker send: header.payload. (no signature)

# ✅ SECURE - Strict algorithm check
jwt.decode(token, SECRET_KEY, algorithms=['HS256'])  # Only HS256

Multi-Factor Authentication (MFA)

# Step 1: User login with password
@app.route('/login', methods=['POST'])
def login():
    user = authenticate(email, password)
    if not user:
        return 'Invalid credentials', 401
    
    # Generate MFA challenge
    mfa_token = secrets.token_urlsafe(32)
    cache.set(f'mfa:{mfa_token}', user.id, expire=300)  # 5 min
    
    # Send OTP
    otp = ''.join(str(random.randint(0, 9)) for _ in range(6))
    send_sms(user.phone, f'Your OTP: {otp}')
    cache.set(f'otp:{mfa_token}', otp, expire=300)
    
    return {'mfa_required': True, 'mfa_token': mfa_token}

# Step 2: User submit OTP
@app.route('/mfa-verify', methods=['POST'])
def mfa_verify():
    mfa_token = request.json['mfa_token']
    otp = request.json['otp']
    
    user_id = cache.get(f'mfa:{mfa_token}')
    correct_otp = cache.get(f'otp:{mfa_token}')
    
    if not user_id or otp != correct_otp:
        return 'Invalid OTP', 401
    
    # Create session
    session_id = secrets.token_urlsafe(32)
    Session.create(session_id, user_id)
    
    # Clean up
    cache.delete(f'mfa:{mfa_token}')
    cache.delete(f'otp:{mfa_token}')
    
    return {'session': session_id}

Brute Force Defense

# ❌ VULNERABLE - No rate limiting
@app.route('/login', methods=['POST'])
def login():
    user = User.find_by_email(request.form['email'])
    if not user or not user.verify_password(request.form['password']):
        return 'Invalid', 401
    return {'session': create_session(user)}

# ✅ SECURE - Rate limiting + account lockout
from flask_limiter import Limiter

limiter = Limiter(app, key_func=lambda: request.remote_addr)

@app.route('/login', methods=['POST'])
@limiter.limit('5 per 15 minutes')
def login():
    email = request.form['email']
    user = User.find_by_email(email)
    
    if user and user.locked_until and datetime.utcnow() < user.locked_until:
        return 'Account locked', 429
    
    if not user or not user.verify_password(request.form['password']):
        # Increment failed attempts
        if user:
            user.failed_login_attempts += 1
            if user.failed_login_attempts >= 5:
                user.locked_until = datetime.utcnow() + timedelta(minutes=30)
            user.save()
        
        return 'Invalid', 401
    
    # Successful login
    user.failed_login_attempts = 0
    user.locked_until = None
    user.save()
    
    return {'session': create_session(user)}

Session Fixation Prevention

# ❌ VULNERABLE - Same session ID after login
def login(username, password):
    if verify_credentials(username, password):
        return {'session': request.cookies.get('session')}  # WRONG!

# ✅ SECURE - Regenerate session
def login(username, password):
    if verify_credentials(username, password):
        old_session_id = request.cookies.get('session')
        # Delete old session
        Session.delete(old_session_id)
        
        # Create new session
        new_session_id = secrets.token_urlsafe(32)
        Session.create(new_session_id, user.id)
        return {'session': new_session_id}

Auth Checklist

• [ ] Passwords hashed dengan Argon2id atau bcrypt
• [ ] Session ID cryptographically random (256+ bit)
• [ ] HttpOnly + Secure + SameSite cookie flags
• [ ] Session timeout (idle + absolute max)
• [ ] Rate limiting on login (5 attempts/15min)
• [ ] Account lockout setelah N failed attempts
• [ ] Session regenerated setelah login
• [ ] MFA available (TOTP preferred over SMS)
• [ ] Password reset flow aman (token dengan expiry)
• [ ] Logout invalidates session
• [ ] No credential logs atau error messages yang leak

Kesimpulan

Authentication & Session = expensive to break, cheap to implement correctly. Use proven libraries, follow best practices, test thoroughly.

Modul berikutnya (#09) membahas HTTPS, TLS, & Certificate Security.

Next: #09 - HTTPS, TLS, & Encryption