# Passwords & sessions

A step of the [Cloud application](https://gradus.kazet.blog/tree/cloud-application) tree on Gradus, in the Security area: Secrets, auth, TLS, input.

Page: https://gradus.kazet.blog/tree/cloud-application/step/passwords-and-sessions

Store passwords with Argon2id through a maintained library and keep users signed in with secure cookie sessions that renew at sign-in.

One option of Sign-in: Passwords you own. The others: Hosted identity provider.

Usually comes after: [Choose how users sign in](https://gradus.kazet.blog/tree/cloud-application/step/choose-sign-in).

Leads to: [Password reset](https://gradus.kazet.blog/tree/cloud-application/step/password-reset).

## Prompt for your AI assistant

```
Read the sign-in decision record in docs/decisions and the users and identities model. Using a maintained library rather than hand-written crypto, add sign-up, sign-in and sign-out endpoints, with no screens yet. Hash passwords with Argon2id at OWASP's current recommended settings, or scrypt or bcrypt where the platform has no Argon2id, keep the settings with the hash and upgrade a stored hash at the next sign-in when they change. Accept long passwords, set no composition rules and reject passwords known from breaches. Keep sessions on the server behind a cookie with the __Host- prefix that is HttpOnly, Secure and SameSite, issue a new session id at sign-in and protect state-changing requests against CSRF. Throttle failed attempts per account and per address, and answer the same way whether or not an account exists. Add a test for each of these.
```

Every step of the tree: https://gradus.kazet.blog/tree/cloud-application/llms.txt