Review authentication changes as a security boundary. Verify credential and token validation, expiry, issuer, audience, signing algorithm, key rotation, revocation/logout behavior, rate limits, and safe error messages. Authorization must be enforced server-side on every protected resource. Check cookies for Secure, HttpOnly, SameSite, narrow Path/Domain, and CSRF defenses. Confirm return URLs are allow-listed, secrets are not logged, and user-controlled claims cannot grant roles or tenant access. Add negative tests for expired/tampered tokens, missing claims, cross-tenant IDs, replay, lockout, and privilege escalation. Also inspect dependency changes and deployment configuration; correct code with unsafe production settings is still vulnerable.
Backbencher Developer · · 0 likes