Add secure login to a web app

This prompt helps you add login without the usual security mistakes. It first asks whether a trusted library or service fits better, then walks through hashing, sessions, cookies, rate limiting and password reset.

text-code-auth-login-flow — claude — 82 words

Act as a security-minded backend developer.

Stack: [e.g. Express + Postgres, or Django]
Login type: [e.g. email and password with email verification]

Explain whether I should use a trusted library or service instead of building this myself, and recommend one for my stack. Then show the setup: password hashing, sessions or tokens, cookie settings, rate limiting on login, password reset with expiring links, and logout. Point out the five most common security mistakes in login code and how this setup avoids them.

Edit in the builder Copy & open Claude ↗Copy & open ChatGPT ↗Copy & open Gemini ↗

For real users, a well-known auth library or service is almost always safer than hand-written login code.

Get a better result

What you will get

Advice on whether to use a trusted auth library or service for your stack, then a setup covering password hashing, sessions or tokens, cookie flags, login rate limits, expiring reset links and logout, plus five common login mistakes and how this avoids them.

Why it works

The first instruction asks whether you should build this at all, which is the most useful security advice for most apps. Naming your stack gets setup code that fits it, not a generic sketch. Listing every piece, from cookie flags to logout, stops the model from stopping at a happy path login form, which is where most homemade login code goes wrong.

Common mistake

It writes password hashing with a general purpose hash.

Fix: Ask for a slow password hashing function made for the job, such as bcrypt, scrypt or Argon2, and never a plain fast hash.

Also watch for

The reset link never expires and can be used twice. Ask for a single use token that expires within an hour and is stored hashed, so a leaked database does not leak working links.
The login error says whether the email exists. Ask for the same message for a wrong email and a wrong password, so attackers cannot test which accounts exist.

Try a variation: add sign in with Google

Ask how to add one social login next to email and password, and how to link the two when the same person uses both.

Still not right? Reply with this

Now walk through this setup as an attacker would. List what you would try first and how the setup stops each attempt.