A practical security guide for web developers
Had this SO link saved since probably soon after it was asked 7 years ago. Still relevant and still being updated.<p><a href="http://stackoverflow.com/questions/549/the-definitive-guide-to-form-based-website-authentication" rel="nofollow">http://stackoverflow.com/questions/549/the-definitive-guide-...</a><p>Includes:<p>- How to log in<p>- How to remain logged in<p>- Managing cookies (including recommended settings)<p>- SSL/HTTPS encryption<p>- How to store passwords<p>- Using secret questions<p>- Forgotten username/password functionality<p>- Use of nonces to prevent cross-site request forgeries<p>..........<p>And much much more.