I am stuck on a boring auth review. I need to trace an authentication flow for privilege gaps, stale sessions, and unsafe defaults, but my current attempt is getting vague and too big. What would you check first?
My notes from fixing a boring auth review
The first answers were broad enough to be useless. This version asks for assumptions, evidence, and a next step.
First, shrink the decision. Do not solve the whole subject at once.
- Reproduce the failure before changing code.
- Keep the patch smaller than the diagnosis.
- Write the rollback before deployment.
Write down the result you need by the end of this session. Then choose one input you trust and make a first pass that can be checked. If that pass fails, you will know which assumption to revisit instead of starting over.
The smaller decision was the missing piece. I was asking for the whole system at once.
3 comments
Sign in to join the conversation.