The outer wall
Every gate that checks a password, sends an email or spends a token is rate limited.
- Limits per IP, per email and per user
- Same 429 whether or not an account exists
- IPv6 grouped by /56, so rotating addresses doesn't help
The defenses
Three walls, no weak gate
Most breaches walk through the one door nobody guarded. CKAuth guards every one of them the same way, whether the account exists or not.
The second wall
No session until the inbox owner proves they're also the person who signed up.
- Single-use email links that expire in 15 minutes
- Verification asks for the sign-up password
- Unverified accounts get no cookies at all
The inner wall
Even with the database in hand, there's nothing an attacker can replay.
- Passwords hashed with bcrypt
- Every token stored as a SHA-256 hash
- Sessions live in httpOnly cookies scripts can't read
Field manual
From cadet to inside, in four moves
No passwords in emails, no codes to copy, no guessing which step comes next.
- Step 01
Enlist
Sign up with your name, email and a strong password. The meter shows how well it holds.
- Step 02
Take the oath
Open the link we email you and confirm with your password. You're signed in on the spot.
- Step 03
Hold your post
Short-lived access, silently refreshed. Each refresh token works once, then it's replaced.
- Step 04
Find your way back
Forgot it? A reset link puts you back inside, and signs out every other device on the way.
Security
Built for the worst day
Assume the attacker knows your users' emails, has a botnet, and one day gets a copy of your database. The walls still hold.
Silent on who's registered
Sign-up, sign-in and recovery answer identically for every email. Only the inbox owner learns the difference.
No one can wear your face
Registering your address with their password gets an impostor nothing: verifying needs both the inbox and the password.
A stolen refresh token dies on use
Tokens rotate on every refresh, and changing or resetting your password ends every other session.
Watchtower log
- $
Your post is waiting
Take your place on the wall
Create an account in under a minute. Verify your email once, and you're in.