Authentication

Authentication answers who are you? Distinct from authorization (what can you do?). Base level for professional service sites: bcrypt-hashed passwords, 2FA optional for staff, session cookies with Secure, HttpOnly, and SameSite=Lax. For client portals, 2FA required.