> For the complete documentation index, see [llms.txt](https://0xn3va.gitbook.io/application-security-handbook/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://0xn3va.gitbook.io/application-security-handbook/web-application/authentication.md).

# Authentication

## Overview

This section contains recommendations for the implementation of authentication mechanisms.

{% hint style="info" %}
Reuse existing authentication mechanisms to avoid duplication and attack surface expansion.
{% endhint %}

## General practices

| Authentication scheme                                   | Proof of identity                    | Pages                                                                                                                                             |
| ------------------------------------------------------- | ------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------- |
| Authentication with login and password                  | `login` & `password`                 | [Authentication with Login and Password](/application-security-handbook/web-application/authentication/authentication-with-login-and-password.md) |
| Authentication with email and password                  | `email` & `password`                 | [Authentication with Login and Password](/application-security-handbook/web-application/authentication/authentication-with-login-and-password.md) |
| Authentication with a phone number and an one-time code | `phone number` & `one-time password` | [Authentication with Phone Number](/application-security-handbook/web-application/authentication/authentication-with-phone-number.md)             |
| OAuth2 authentication                                   | `third-party system`                 | [OAuth 2.0 Authentication](/application-security-handbook/web-application/authentication/oauth-2.0-authentication.md)                             |
| Multi-factor authentication                             | `one time password`                  | [Multi-factor Authentication](/application-security-handbook/web-application/authentication/multi-factor-authentication.md)                       |