Audit advanced Works with: Any AI

Authentication Code Review: Passwords and Tokens

Rubric scoring Has example

Review login, hashing, and token code.

The Open buttons send the prompt text as currently shown below to that site only when you click. Fill in the placeholders first.

Review my authentication code and score it. Language and framework: [LANGUAGE_AND_FRAMEWORK]. Code for signup, login, password reset, and token issuing (secrets removed): [PASTE_CODE].

Score each area from 0 (absent or dangerous) to 3 (good practice), quote the lines that justify the score, and give the fix as code:
1. Password storage: a slow, salted algorithm (for example Argon2id, bcrypt, scrypt) and sensible cost settings.
2. Password rules: length over complexity, breach checks, no silent truncation.
3. Login: rate limiting, lockout or delay, generic error messages, no user enumeration.
4. Password reset: single-use, short-lived, unguessable tokens; no token in logs; invalidating sessions after reset.
5. Token design: signature algorithm fixed server-side, expiry, audience and issuer checks, refresh token rotation, storage location.
6. Multi-factor support and recovery flow.
7. Logging and alerts for suspicious attempts.

Total the score out of 21 and list the three highest-risk issues first, with an exploit scenario for each in two sentences. Do not suggest writing my own cryptography. End with the questions you need answered about my deployment.

Fill in before use

Optional: type your details and the prompt above updates. Nothing is saved or sent.

Replace each bracketed placeholder with your own details, then paste into Any AI or another assistant.

1. Password storage: 1/3. Line 22 uses SHA-256 with no salt. Fix: Argon2id via the library's default parameters.
2. Password rules: 2/3. Minimum 8 characters, no breach check.
3. Login protection: 0/3. No rate limit; error messages differ for unknown email versus wrong password (user enumeration).
4. Password reset: 2/3. Token expires in 1 hour, but is not single use.
5. Tokens: 1/3. Algorithm read from the token header; pin it server-side. 30-day expiry.
Total 6/21.
Top risk: unsalted fast hashes mean a database leak exposes most passwords within hours. Scenario: attacker dumps the users table and cracks common passwords offline.

• authentication
• passwords