What are secure coding practices for authentication systems?

• A. Do not use multi-factor authentication.
• B. Use established authentication frameworks, enforce multi-factor authentication, store password hashes with strong algorithms (bcrypt/Argon2), secure session management, and protect credentials.
• C. Store passwords in plaintext.
• D. Share credentials across services.

Answer: (B)

The main concept is building authentication with defense-in-depth using proven patterns. Use established authentication frameworks so you don’t reinvent the wheel and you get secure defaults that have been tested in real-world apps. Enforcing multi-factor authentication adds a second verification factor, making it much harder for an attacker to gain access even if a password is compromised. Storing password hashes with strong algorithms like bcrypt or Argon2, along with salts and appropriate work factors, protects passwords if the data store is breached because these methods resist brute-force and rainbow-table attacks. Secure session management means issuing and handling session tokens safely—short-lived, rotated on login, and stored in HttpOnly, Secure cookies to guard against XSS and cookie theft—while preventing session hijacking and fixation. Protecting credentials everywhere is essential: never store or log plaintext passwords, ensure data in transit is encrypted with TLS, and avoid sharing credentials across services. Together, these practices form a robust, practical approach to secure authentication.

Other options would expose weaknesses by suggesting insecure storage or sharing of credentials or omitting MFA, which would significantly raise the risk of compromised accounts.