Email/Password Authentication Checklist

Here is a fairly rough checklist of things you should think of when building an email/password authentication system for a fairly sensitive application. This assumes the basics like securely hashing passwords, proper session management, and transmitting data over SSL are already covered. For a more comprehensive list, see the OWASP Cheat Sheet on Authentication . Ensure passwords are a minimum of…