Your Session Cookie Is Basically a Temporary Password - Part 1

When developers think about authentication security, passwords usually get most of the attention. Use strong passwords. Hash them properly. Add MFA. Rate-limit login attempts. All of that matters. But something interesting happens after a user successfully logs in: The password usually stops being involved. The application still needs a way to...