Authentication & Authorization Architecture · Strong Authentication and Federation
Account Recovery and Abuse Prevention
Secure password resets, account takeover detection and login abuse controls.
Attackers target the weakest path to an account — often recovery. Use single-use, short-lived, hashed reset tokens; don't reveal whether an email exists; require MFA or step-up verification for sensitive changes (email, password, MFA settings); notify users of security events; and revoke sessions after resets. Detect account takeover with signals like new devices, impossible travel and credential-stuffing patterns, and respond with step-up challenges.
Security events to log and alert on
- login.failed (per account + per IP rates) - mfa.disabled / mfa.method_added
- password.reset_requested / completed - email.changed (notify OLD address)
- session.created from new country/device - api_key.created
Responses: rate limit → CAPTCHA/challenge → step-up MFA → temporary lock → notify user
Common pitfalls
- Security questions as recovery (guessable, researchable).
- Changing the account email without notifying the old address.
- Permanent lockouts that let attackers lock out victims (prefer throttling).
Key points
- Recovery must be as strong as login
- Step-up auth for sensitive changes
- Monitor and notify on security events
Further reading: OWASP Forgot Password Cheat Sheet
Practice questions
Why notify the old email address when a user changes their email?
Answer
If an attacker took over the account, the notification alerts the real owner, who may otherwise lose all access silently.
Why is hard account lockout after N failures risky?
Answer
Attackers can deliberately lock out victims (denial of service). Progressive delays, CAPTCHAs and step-up challenges limit guessing without enabling lockout attacks.
Open in the app to mark lessons complete, take notes and track your progress.