Part 6 of the security fundamentals series. Authentication versus authorization, the MFA factors and which ones resist phishing, and the four access control models with code-level examples, least privilege and access reviews.
A few percent of logins failed with a generic error after we added a Cognito post-authentication trigger that recorded login events in our database. The Lambda ran in a VPC, opened a database connection on cold start, and sometimes exceeded Cognito's 5-second trigger timeout. How we moved the work off the login path.
A security review found that our password reset tokens and temporary passwords came from Python's random module. Its Mersenne Twister generator is fast and statistically good, but not unpredictable. We moved to secrets, hashed tokens at rest, and added Bandit to CI.
A small share of users reported that their authenticator codes were rejected, but only sometimes. One application server's clock ran 70 seconds behind, so codes failed whenever a login reached it. How we found it, fixed time sync, and kept a tight verification window with replay protection.
An internal reporting service read the user ID and role from a JWT with jwt.decode(), which never checks the signature. A route that bypassed our gateway let any edited token through. We switched to verification with a pinned algorithm, issuer, audience and JWKS rotation.