A07:2025 — Authentication Failures

01 Identification & Session Vulnerabilities

Authentication mechanisms are vulnerable to compromise when any of the following flaws exist:

Permissive Brute Force & Credential Stuffing: Absence of rate limiting, IP throttling, or CAPTCHA on login and 2FA submission forms.
Session Fixation: Reusing the pre-authentication session identifier after successful login rather than regenerating the session ID.
Insecure Password Recovery: Secret questions, predictable reset links, or tokens that do not expire upon use or password change.
Improper Session Invalidation: Logout operations that only delete client-side cookies without invalidating the active session in server-side stores (Redis/database).

02 Vulnerability Demonstration & Test Triggers

Vulnerable Implementation: Session Fixation & Unconstrained Login

Failure to regenerate session ID post-authentication and absence of rate throttling.

vulnerable_login.phpPHP

session_start();

// VULNERABLE: No session regeneration, no rate limiting
if ($_POST['username'] && $_POST['password']) {
    $user = checkCredentials($_POST['username'], $_POST['password']);
    if ($user) {
        // Keeps old pre-auth session ID! (Session Fixation flaw)
        $_SESSION['authenticated'] = true;
        $_SESSION['user_id'] = $user['id'];
        header("Location: /dashboard");
        exit;
    }
}

03 Audit & Static Code Analysis Rules

Anti-Pattern	Audit Signature	Remediation Requirement
Missing Session Regeneration	`\$_SESSION\['.'\]\s=.*(?!session_regenerate_id)`	Call `session_regenerate_id(true)` on login
Weak Session Cookie Flags	`session_set_cookie_params` without `Secure; HttpOnly; SameSite=Strict`	Enforce full cookie security attributes
Unthrottled Login	Endpoint routing without rate limiter middleware	Token bucket / Redis rate limiting

04 Hardened Authentication Standard

Secure Session Lifecycle & Throttled Login

secure_login.phpPHP 8+

function secureAuthenticateUser(PDO $pdo, string $username, string $password, string $clientIp): bool {
    // 1. Rate Limiting check (max 5 failed attempts per 15 minutes)
    $attempts = getFailedAttempts($username, $clientIp);
    if ($attempts >= 5) {
        throw new AuthenticationThrottledException("Too many failed attempts. Try again in 15 minutes.");
    }

    // 2. Fetch user hash & verify timing-safe
    $stmt = $pdo->prepare("SELECT id, password_hash, mfa_secret FROM users WHERE username = :u AND is_active = 1");
    $stmt->execute([':u' => $username]);
    $user = $stmt->fetch(PDO::FETCH_ASSOC);

    if (!$user || !password_verify($password, $user['password_hash'])) {
        recordFailedAttempt($username, $clientIp);
        return false;
    }

    // 3. Clear failed attempts on success
    clearFailedAttempts($username, $clientIp);

    // 4. PREVENT SESSION FIXATION: Regenerate ID and wipe pre-auth session
    session_regenerate_id(true);

    // 5. Store authoritative session data
    $_SESSION['auth_user_id'] = $user['id'];
    $_SESSION['auth_time'] = time();
    $_SESSION['last_activity'] = time();
    $_SESSION['user_agent_hash'] = hash('sha256', $_SERVER['HTTP_USER_AGENT'] ?? '');

    return true;
}

05 Verification & Compliance Checklist

Control	Requirement	Status
Multi-Factor Authentication	Mandatory TOTP / WebAuthn for privileged and administrative roles.	Enforced
Session Flags	`HttpOnly`, `Secure`, and `SameSite=Lax/Strict` on all cookies.	Enforced
Session Regeneration	New session ID issued on every privilege escalation and login.	Enforced

A07:2025 — Identification & Authentication Failures