OWASP A07: Authentication Failures (1) — Brute Force, Lockout and NIST Password Rules
We start with a login endpoint that accepts unlimited attempts and reveals whether a user exists through its message and its response time. We separate brute force from credential stuffing, compare Identity's default password rules with NIST SP 800-63B-4, fix it with a blocklist validator, lockout and a uniform response, and take a short look at MFA and passkeys.
6 Nov 2026
·
10 min
·
5
