Login, sessions and MFA: an application security checklist

Security continues after sign-in

A session lets an application recognise a signed-in user across requests. If a session token is stolen, it may allow access without another login. Session handling, recovery and privileged actions therefore need review alongside passwords or one-time sign-in codes.

Review the full account lifecycle

Include registration, email confirmation, sign-in, password reset or magic links, email changes and account deletion. Consider what happens when an attacker knows an email address, has an old recovery link or uses a session created before a security setting changed.

Session checks

Select expiry and reauthentication requirements based on the sensitivity of the service. Assess them in the actual deployed application.

• Use HTTPS and protect session tokens from unnecessary exposure
• Check idle and absolute expiry where configured
• Verify logout behaviour and available session revocation
• Avoid tokens in URLs, analytics and ordinary logs
• Require fresh authentication for particularly sensitive changes

MFA needs a recovery plan

Protect factor enrolment, replacement and removal, not just the code prompt. Recovery must not become an easier route around MFA. For administrators, enforce the required assurance on the server before privileged data access rather than relying on an interface prompt.

Use realistic test accounts

Test an ordinary user, a privileged user and a signed-out request. Check that failed authentication cannot leave behind a partly privileged session. Keep test tokens and recovery material out of screenshots and reports that will be shared widely.