auth-hardeninglisted

# Auth Hardening Authentication is the front door of an application. Most real breaches don't come from exotic exploits — they come from ordinary mistakes in how login, sessions, and logout are built. This skill's job is to catch those mistakes and replace them with proven patterns, then prove the fix works. The guiding rule throughout: **the server is the only place trust lives.** Any check on the client is user experience, not security. If a control isn't enforced server-side, treat it as absent. ## When to reach for this skill Use it the moment a task touches any of: a login or logout endpoint, session cookies or JWTs, password storage or reset, "remember me" / refresh tokens, account lockout, or OTP/MFA. Reviewing existing auth code counts too — you don't need the user to say "harden," just to be working in this area. ## Workflow Work through these five areas in order. Each has a "get it right" standard and a matching failure to hunt for. Don't skip to code before understanding which stack and session model the user has — read what exists first, then apply the standards. ### 1. Password storage The standard: hash with a slow, salted, memory-hard algorithm — **argon2id** (preferred) or **bcrypt**. Never MD5, SHA-1, SHA-256, or HMAC-SHA256 for passwords. Fast hashes exist to be fast; that is exactly wrong for passwords, because it lets an attacker who steals the database try billions of guesses. Note the distinction that trips people up: HMAC-SHA256 is a fine choic