Better Auth Best Practices

For Acme Corp’s Lever ATS (Applicant Tracking System), the current authentication system relies solely on password-based login with no multi-factor authentication (MFA) or session timeout policies. Three critical security gaps were identified:

1. **Password Weakness**: The system enforces a minimum 8-character password with no complexity requirements, making accounts vulnerable to brute-force attacks. Acme’s 2023 security audit revealed 12% of employee accounts used passwords from the top 1000 most common passwords (e.g., 'Password123').

2. **Lack of MFA**: Only 3% of users have enabled MFA, leaving the system exposed to credential stuffing attacks. Lever’s API supports TOTP (Time-based One-Time Password) and WebAuthn, but these features are disabled by default in Acme’s configuration.

3. **Unlimited Session Duration**: User sessions remain active indefinitely after login, increasing the risk of account takeover if credentials are compromised. For example, a former employee’s account remained active for 6 months after departure, granting access to sensitive candidate data.

**Recommended Fixes**:
- Enforce password complexity: Require 12+ characters with mixed case, numbers, and symbols. Integrate with a password manager like Bitwarden for secure storage.
- Enable MFA by default: Configure Lever to require TOTP for all admin and recruiter accounts. Provide step-by-step guides for employees to set this up.
- Implement session timeout: Set a 15-minute inactivity timeout for sensitive roles (e.g., hiring managers) and a 4-hour timeout for standard users. Use Lever’s session management API to enforce this.

**Code Snippet (Python - Flask)**:
```python
from flask import Flask, session
from datetime import timedelta

app = Flask(__name__)
app.secret_key = os.getenv('FLASK_SECRET_KEY')
app.permanent_session_lifetime = timedelta(minutes=15)  # For admin roles

@app.route('/login', methods=['POST'])
def login():
    if not validate_mfa(session.get('user_id')):  # Check MFA status
        return "MFA required", 403
    session.permanent = True
    return "Login successful"
```

These changes would reduce Acme’s attack surface while improving compliance with SOC 2 and GDPR requirements for candidate data protection.