Notifications
Clear all
Topic starter
06/06/2026 11:21 am
TL;DR: Authentication failures now span the full lifecycle from sign-up to session monitoring, with bot farms, credential stuffing, disposable email abuse, enumeration, and token theft all creating distinct risks, according to WorkOS. The real issue is not a single weak control but a chain of assumptions that break once attackers can mimic normal user behaviour at scale.
NHIMG editorial — based on content published by WorkOS: The developer's guide to authentication security
By the numbers:
- Solver services like 2captcha employ humans to solve challenges in real time for $1–3 per thousand solves, with API latencies under 10 seconds.
- Mobile abandonment rates of 30–50% have been reported for difficult CAPTCHA challenges.
- Machine learning models defeat reCAPTCHA v2's image challenges with over 90% accuracy.
Questions worth separating out
Q: How should security teams stop email enumeration during sign-up and login?
A: Use identical user-facing responses for existing and non-existing accounts, and keep timing, status codes, and validation paths consistent.
Q: Why do CAPTCHA-based bot defences fail so often?
A: Bots now execute JavaScript, keep session state, and mimic human interaction well enough that simple challenge-response checks are no longer reliable.
Q: What breaks when session tokens are stored insecurely?
A: If tokens are readable by browser scripts or are not rotated and revoked correctly, a single XSS issue or stolen token can preserve attacker access after login.
Practitioner guidance
- Normalise account-existence responses Return the same visible message, status pattern, and response timing for registered and unregistered identities so sign-up and login endpoints do not become enumeration tools.
- Replace single-signal bot checks Use behavioural analysis across timing, navigation, and device fingerprint consistency instead of relying on CAPTCHA or user-agent checks alone.
- Harden session lifecycle controls Regenerate session identifiers on successful login, store tokens where scripts cannot read them, and enforce revocation when passwords change or accounts are disabled.
What's in the full article
WorkOS's full guide covers the operational detail this post intentionally leaves for the source:
- Browser fingerprinting and behavioural scoring patterns for distinguishing bots from legitimate users
- Step-by-step handling of disposable email domains, including daily list maintenance and subdomain blocking
- Session and token hardening details for JWT validation, cookie settings, and revocation logic
- Practical detection patterns for dormant account reactivation and account-sharing behaviour
👉 Read WorkOS's guide to authentication threats across the full lifecycle →
Authentication lifecycle threats: where sign-up and sign-in break?
Explore further
06/06/2026 12:05 pm
Authentication security fails when the programme treats sign-in as the whole problem. The article shows that the attack surface begins before authentication and continues long after it, through sign-up abuse, session handling, and recovery flows. That means identity governance is not just about proving a user once. Practitioners have to govern the full lifecycle or accept that attackers will move sideways into the weakest phase.
A few things that frame the scale:
- The average estimated time to remediate a leaked secret is 27 days, despite 75% of organisations expressing strong confidence in their secrets management capabilities, according to The State of Secrets in AppSec.
- Only 44% of developers are reported to follow security best practices for secrets management, exposing a significant developer behaviour gap.
A question worth separating out:
Q: How should organisations govern authentication across the full lifecycle?
A: Treat sign-up, sign-in, recovery, and ongoing session monitoring as separate but connected control points. Each stage needs its own abuse checks, logging, and response logic. If any one stage is weak, attackers can bypass the rest even when the original login flow looks strong.
👉 Read our full editorial: Authentication lifecycle threats are evolving beyond password guessing
