Authentication and Session Management

Authentication verifies the identity of a user, while session management maintains that verified identity across multiple requests. Weaknesses in either area can allow attackers to impersonate legitimate users, access unauthorised data, or take over accounts entirely.

---

Authentication Fundamentals

Authentication answers the question: "Who are you?"

There are three factors of authentication:

Factor	Type	Examples
Something you know	Knowledge	Password, PIN, security question
Something you have	Possession	Mobile phone (SMS/TOTP), hardware token, smart card
Something you are	Inherence	Fingerprint, face recognition, iris scan

Multi-factor authentication (MFA) requires two or more factors from different categories. Using a password and a security question is not MFA because both are knowledge factors.

---

Password Security

Common Password Vulnerabilities