auth-hardeninglisted

# Auth Hardening Authentication is where almost every public-facing app eventually gets attacked. The good news: a small set of patterns covers most of the threat surface, and the worst practices (password rotation every 90 days, "security questions") are actively harmful. This skill is opinionated. The opinions track NIST SP 800-63B, OWASP ASVS, and industry consensus circa 2026. ## When to invoke - Building auth from scratch - Reviewing an existing auth system before scaling user count - Handling a credential-stuffing wave or a brute-force surge - Planning MFA rollout for staff or customers - After a password-reset abuse incident or account-takeover report - Migrating from sessions to JWT (or back) ## Password policy — what to require, what to drop **Require**: - **Minimum length 12 characters**, no maximum below 64. Length beats complexity. - **Allow all printable characters and spaces** — including emoji and unicode. Reject only NULL bytes. - **Check against breached-password lists** at signup and reset. Use Have I Been Pwned's k-anonymity range API (only first 5 chars of hash leave your server). **Drop**: - **No mandatory rotation.** NIST 800-63B explicitly removed periodic rotation in 2017 because it produces predictable patterns (`Password1!` → `Password2!`). - **No composition rules** ("must contain a symbol"). They reduce entropy by making patterns predictable. - **No security questions.** Mother's maiden name is on LinkedIn. Pet's name is on Instagram. - **