SCP03 Authentication and Password Management
What this means
SiteShadow flagged authentication and password handling patterns that are weak, inconsistent, or easy to bypass (weak password storage, missing MFA/lockouts, insecure reset flows, over-trusting client state).
Why it matters
Weak authentication enables account takeover and credential abuse.
- Credential stuffing and brute-force attacks succeed when rate limits/lockouts are missing.
- Offline cracking succeeds when passwords are stored with fast/unsalted hashes (see
CWE-916/CWE-759). - Account recovery abuse can be worse than login if reset tokens are weak.
Safer examples
1) Store passwords with a password hashing algorithm
import bcrypt
pw_hash = bcrypt.hashpw(password.encode("utf-8"), bcrypt.gensalt())2) Rate limit and lock out repeated failures
Limit by user and IP; add progressive delays for repeated failures (see RATE01-02 / CWE-799).
3) Make reset tokens high-entropy and short-lived
Use CSPRNG tokens, single-use, expiry, and bind to the account.
How SiteShadow detects it (high level)
- Detects weak password storage patterns and risky auth flows (reset/verify tokens, missing lockouts).
- Flags authentication decisions relying on untrusted client input.
References
- OWASP Secure Coding Practices: https://owasp.org/www-project-secure-coding-practices-quick-reference-guide/
---