Login and Session Security Checklist
Review authentication flows for common weaknesses.
The Open buttons send the prompt text as currently shown below to that site only when you click. Fill in the placeholders first.
Review the login and session design of my website with a decision tree. Platform or framework: [PLATFORM]. Login method (password, magic link, social login, single sign-on): [LOGIN_METHOD]. Details I know about sessions, cookies, password reset, and multi-factor options: [SESSION_DETAILS]. Walk through the nodes and report my path: 1. Passwords: are they stored hashed with a modern slow algorithm? If unknown, give me the test or question to ask my developer or host. Are there length rules and a check against common passwords? 2. Brute force: IF there is no rate limiting or lockout THEN list quick protections. 3. Multi-factor authentication: IF not offered THEN recommend it at least for admins and show a rollout order. 4. Sessions: IF cookies lack Secure, HttpOnly, or SameSite settings THEN list the changes. Are sessions ended on logout and password change? Is there an idle timeout? 5. Password reset: IF links are long-lived, reusable, or reveal whether an account exists THEN fix. 6. Error messages: generic? 7. Admin area: separate protection, limited access by IP or role? 8. Alerts: notification of new device logins. Output a table: Control | Status | Risk | Fix | Effort. Add the three highest-priority changes and a plain-language explanation I can send to a developer.
Fill in before use
Optional: type your details and the prompt above updates. Nothing is saved or sent.
Replace each bracketed placeholder with your own details, then paste into Any AI or another assistant.