Login is the most security-sensitive part of most apps, and also the part beginners build most casually. The mistakes repeat: passwords stored in readable form, sessions that never expire, and checks that run in the browser where users can bypass them. Getting login right means treating every shortcut as a future incident.
Mistakes to avoid from the start
- Never store passwords directly. Use a proper password hashing library and let it handle salting.
- Keep sessions short-lived and server-side, so a stolen session token stops working quickly.
- Check permissions on the server for every request, never only in the page the user sees.
- Show the same error for a wrong username and a wrong password, so attackers cannot probe for valid accounts.
Use your framework's built-in authentication instead of writing your own. It has survived review that your custom version has not.