Authentication taste

# Authentication taste of a security-minded backend engineer - Use a well-maintained auth library or provider instead of hand-rolling login, sessions and token handling. Confidence: 0.95 - Hash passwords with Argon2id, or bcrypt with a cost of at least 12, and never with a plain fast hash like SHA-256. Confidence: 0.95 - Prefer server-side sessions in HttpOnly, Secure, SameSite=Lax cookies for first-party web apps over JWTs in localStorage. Confidence: 0.90 - Use short-lived access tokens with rotating refresh tokens when you truly need stateless tokens for APIs or mobile clients. Confidence: 0.85 - Detect refresh token reuse and revoke the whole token family when it happens. Confidence: 0.85 - Regenerate the session ID on login, logout and privilege changes to prevent session fixation. Confidence: 0.95 - Offer passkeys (WebAuthn) as a first-class sign-in method, not only as a second factor. Confidence: 0.80 - Support TOTP or passkeys for MFA and treat SMS codes as a last-resort fallback. Confidence: 0.85 - Rate limit login, signup and password reset per account and per IP, with exponential backoff instead of hard permanent lockouts. Confidence: 0.90 - Return the same generic message for unknown email and wrong password so accounts cannot be enumerated. Confidence: 0.90 - Make password reset and magic link tokens single-use, random, hashed at rest and expiring within 15 to 60 minutes. Confidence: 0.95 - Check passwords against known breached lists and drop arbitrary composition rules like "one symbol required". Confidence: 0.85 - Use OAuth 2.1 Authorization Code with PKCE for every client, and never the implicit flow. Confidence: 0.95 - Validate the state and nonce parameters on every OAuth and OIDC callback. Confidence: 0.95 - Link social logins to existing accounts only after the provider returns a verified email. Confidence: 0.90 - Keep authentication (who you are) separate from authorization (what you can do) and check permissions on the server for every request. Confidence: 0.95 - Re-ask for credentials or a passkey before sensitive actions like changing email, password or payout details. Confidence: 0.85 - Notify users by email on new device sign-ins, password changes and MFA changes. Confidence: 0.80 - Let users see and revoke their active sessions from account settings. Confidence: 0.80 - Log auth events with user ID, IP and user agent, but never log passwords, tokens or reset links. Confidence: 0.95 - Protect cookie-based state-changing requests with SameSite cookies plus CSRF tokens or Origin header checks. Confidence: 0.90 - Store signing keys in a secrets manager and support key rotation with a kid header from day one. Confidence: 0.85 - Write integration tests for the unhappy paths: expired tokens, revoked sessions, replayed links and wrong tenants. Confidence: 0.85