nueltek/authentication-handbook

The Authentication Handbook is not code you run, it is a free downloadable PDF guide that walks through one complete, detailed way to build secure login systems for web apps, from the database schema all the way to shipping the feature. Instead of listing several possible approaches and letting the reader choose, it commits to one full architecture and explains the reasoning behind each decision. There are two editions. The original uses Node.js, TypeScript, Fastify, PostgreSQL, and Redis and is 52 pages. A second edition swaps in core PHP and MongoDB instead, is 64 pages, and adds extra material on preventing NoSQL injection and isolating data between tenants, since MongoDB does not have the same built-in row-level security features that PostgreSQL has. The guide covers topics such as email verification with one-time codes or links, password rules, session handling and refresh tokens, multi-factor authentication using authenticator apps or passkeys, password reset flows, rate limiting with specific production numbers rather than vague advice, protecting against bots, audit logging, and defenses against common attacks like CSRF, XSS, and SQL or NoSQL injection. It also includes a full specification of API endpoints, guidance on error handling and testing, a deployment checklist, and a mapping to OWASP's well-known security standards. The README explicitly suggests pasting individual chapters into an AI coding assistant like Claude or ChatGPT as reference material when building a specific authentication feature, then checking the generated code against the callouts in that chapter before using it. It is aimed at developers who want one trustworthy reference instead of many conflicting tutorials, teams who want a shared security baseline to review code against, and non-coders using AI assistants who want their generated login system to be built on a sound design. The handbook is released under a Creative Commons license that allows free personal and commercial use, including as reference material fed into AI tools.