Wrote a brief recap of "permission" and "login" for authentication from my work in JavaScript malwares. It was a rush outline article with citations. Large bi

Wrote a brief recap of "permission" and "login" for authentication from my work in JavaScript malwares. It was a rush outline article with citations. Large binning, salting of hash, and revocatable are my criteria. Some toolkits that went out the window firstly are: * auth0, * Fusion auth, and * Gluu. So, some of the basic criteria are: * User and password login instead of plain HTTP session cookies. * HTTP-only over TLS v1.2+ (secured HTTP, HTTPS) * ECDSA 1K or better * SameSite [1] * __Host prefix [1] * preload HTTP Strict-Transport-Security header line [2] * Bearer token supplied by API clients * Don’t listen on port 80… like ever. Or revoke token if over non-port 443. * DO NOT use JWT [3] * DO NOT use CORS [4] Hope the citations help more. JWT, not recommended, IMHO. https://egbert.net/blog/articles/authentication-for-api.html https://egbert.net/blog/articles/authentication-for-api.html