Secure Login System
Production-grade authentication built to withstand the OWASP Top 10 — every security control implemented at the right layer.
Design Philosophy
Most "secure login" tutorials implement one or two controls and call it done. This project was built from the perspective of someone who has spent time breaking authentication — understanding what actually fails in CTF challenges and real applications, then building the correct defense for each attack vector.
The guiding principle: every security control is implemented at the layer where it is actually enforced, not just where it is convenient to add.
Security Controls
| Attack Vector | Control | Implementation |
|---|---|---|
| Password cracking | Argon2id hashing | Memory-hard algorithm — GPU/ASIC brute force is computationally infeasible. Replaces bcrypt which is GPU-parallelizable. |
| SQL injection | ORM parameterized queries | SQLAlchemy ORM — user input never touches SQL string construction. Zero raw query strings in the codebase. |
| CSRF attacks | Flask-WTF CSRF tokens | Every state-changing form (login, register, change password) requires a valid CSRF token tied to the session. |
| Brute force | Per-IP rate limiting | Max 5 login attempts per IP per 15-minute window. Implemented at the route level before any authentication logic runs. |
| Credential stuffing | Account lockout | Account locked after 10 failed attempts regardless of IP rotation. Unlock via email link only. |
| Session hijacking | Secure cookie flags | HttpOnly (no JS access), Secure (HTTPS only), SameSite=Strict (no cross-site sending). Session tokens are cryptographically random UUIDs. |
| Privilege escalation | Blueprint-based role separation | Admin and user routes in separate Blueprints with independent auth decorators. No role stored client-side. |
Architecture
secure-login-system/
├── app/
│ ├── __init__.py ← App factory pattern
│ ├── auth/
│ │ ├── routes.py ← Login, register, logout
│ │ ├── forms.py ← Flask-WTF forms with CSRF
│ │ └── utils.py ← Rate limiter, lockout logic
│ ├── admin/
│ │ └── routes.py ← Admin blueprint (separate auth)
│ ├── models.py ← SQLAlchemy User model
│ └── extensions.py ← db, login_manager, csrf
├── migrations/ ← Flask-Migrate history
├── config.py ← Environment-based config
└── run.py ← Entry pointThe app factory pattern (create_app()) means the application can be instantiated with different configs for development, testing, and production without changing any application code.