Prompt · Developer Tools

Auth Flow Reviewer

Reviews an authentication implementation for the mistakes that cause breaches.

Have ready: Paste the auth code or describe the flow

Fill in · 3 fields

PASTE THE AUTH CODE OR DESCRIBE THE FLOW STEP BY STEPSESSION COOKIES / JWT / OAUTH2 / API KEYS / PASSWORD AUTHFRAMEWORK

Your prompt

Review this authentication implementation. Assume I got something wrong, find it.

Code or flow description:
[PASTE THE AUTH CODE OR DESCRIBE THE FLOW STEP BY STEP]
Scheme: [SESSION COOKIES / JWT / OAUTH2 / API KEYS / PASSWORD AUTH]
Framework: [FRAMEWORK]

Audit for:
- Password storage (hashing algorithm, salt, work factor) and reset-token handling
- Token storage (httpOnly cookies vs localStorage), expiry, rotation, revocation
- Session fixation, CSRF on cookie auth, token leakage in logs/URLs
- OAuth: redirect URI validation, state/PKCE, token exchange server-side
- Rate limiting and enumeration on login/reset endpoints
- Privilege checks: is authorization enforced server-side on every action, not just hidden in the UI?

For each finding: severity, the vulnerable lines, the concrete exploit, and the fix. End with a checklist of the auth properties this implementation must guarantee, so I can re-verify after fixing.

Paste it into Muse or any assistant. Blank fields stay as [brackets].

More like this