Operate and test authentication

Authentication is a living production system. Algorithms, providers, dependencies, threats, and user sessions change after launch.

Log safe security events without credentials, alert on meaningful anomalies, let users review and revoke sessions, rotate signing and provider secrets, and keep auth libraries current. Test enumeration, CSRF, XSS impact, authorization, rate limits, reset, session theft, and rollback behavior.

Logs should describe decisions without becoming a second credential store. Useful events include login success and failure, lockout or challenge activation, session creation and revocation, password reset, factor changes, and authorization denial. Record stable internal identifiers and coarse context; never record passwords, raw session IDs, reset links, authorization codes, or recovery codes.

Alert on patterns tied to an abuse hypothesis, not every failure. A burst across many accounts suggests password spraying. Many networks failing against one account suggests targeted guessing. A new country immediately followed by factor removal suggests takeover. Thresholds need production tuning and a way for support to see why a user was challenged.

Users should be able to inspect active sessions with understandable device and recent-activity information, then revoke one or all of them. Administrators need an audited emergency path for global revocation. Secret rotation needs overlap rules: introduce the new signing key, accept the old key only for a bounded period, then remove it. A runbook should say who can perform each step.

Test properties across the whole system, not just endpoint success cases. Compare observable responses for account enumeration, replay reset and OAuth callbacks, race two token redemptions, attempt CSRF on every cookie-authenticated mutation, mutate resource identifiers, simulate a stolen session, and fail the session store and email provider. Verify that outages fail closed where authority is uncertain without turning every dependency problem into a user lockout.

Write two short incident playbooks: one for a stolen session database and one for a compromised OAuth client secret. Include detection evidence, containment, credential or session revocation, user communication, recovery, and the follow-up change that prevents recurrence. Then turn the key checks into a release checklist owned by a named team rather than an unactioned document.