Before enabling auth in production, review every item below.
- [ ] HTTPS is enforced and proxy headers are trusted only from known infrastructure.
- [ ] Session cookies are HTTP-only, secure, and configured with a deliberate SameSite policy.
- [ ] Session expiry, invalidation, and sign-out behavior are tested.
- [ ] Password hashing parameters are configured and benchmarked on production-class hardware.
- [ ] Sign-in, sign-up, password reset, and verification endpoints are rate-limited.
- [ ] Input schemas are validated at server boundaries.
- [ ] Authorization is checked on every privileged server operation.
- [ ] Database migrations are run through a controlled release process.
- [ ] Email delivery uses a real provider, verified sender, and monitoring.
- [ ] Recovery and verification messages do not reveal whether an account exists.
- [ ] Secrets and session tokens are not logged or exposed to client components.
- [ ] Backup, restore, account deletion, and incident response procedures are documented.
- [ ] Dependencies and supported versions are pinned and reviewed.
Veap provides authentication building blocks; it does not remove the application's responsibility to configure secure cookies, rate limits, authorization policy, transport security, or operational monitoring.
