Which aspect best ensures secure authentication system design?

• A. Secure session management to prevent session fixation and hijacking.
• B. Increase performance at the expense of security.
• C. Reuse credentials across apps.
• D. Share sessions.

Answer: (A)

Secure authentication design rests on how you manage the user’s session after login. The best approach focuses on robust session management because it directly protects the authenticated state from common attacks like session fixation and session hijacking. This means generating unpredictable session identifiers, rotating the session ID at login, binding the session to the user, and protecting cookies with HttpOnly, Secure, and SameSite attributes. It also means setting appropriate timeouts, revoking sessions when users log out, and invalidating sessions after potential risk events or longer inactivity. When these practices are in place, attackers find it much harder to hijack a session or reuse an old one, which preserves the integrity of authentication.

Why the other ideas don’t fit: prioritizing performance at the expense of security can open doors to vulnerabilities that undermine authentication. Reusing credentials across apps creates a single point of compromise across environments, increasing risk. Sharing sessions removes isolation between applications, enabling attackers who compromise one context to access others. In short, strong session management directly protects the authenticated state and prevents the most common threats to secure authentication.