Use a trusted authentication flow
Choose a maintained authentication library or provider and follow its current setup guidance. Avoid inventing password handling or session cryptography yourself.
Use HTTPS in production and set cookies with appropriate secure, HTTP-only, and same-site options for the app's needs.
Protect every sensitive action
A hidden button is not authorization. Check the user's permissions on the server for every action that reads or changes private data.
Validate values on the server even when the browser already validates the form. Treat all incoming requests as untrusted.
Plan for recovery and maintenance
Provide a safe account recovery process and avoid revealing whether a private account exists in a public response.
Keep dependencies updated, limit login attempts where appropriate, and review logs without recording passwords, tokens, or other secrets.