Skip to main content

User Authentication & Authorization in Apps: CRA Best Practices

User authentication (proving who they are) and authorization (what they are allowed to do) are fundamental to app security. The EU Cyber Resilience Act (CRA) makes robust access control a core requirement.

Protecting Against Unauthorized Access​

A key essential cybersecurity requirement under the CRA is that products with digital elements must "ensure protection from unauthorised access by appropriate control mechanisms, including but not limited to authentication, identity or access management systems" (Annex I, Part I, Point 2d).

For your app, this means implementing strong:

  1. Authentication Mechanisms:

    • Strong Password Policies: Enforce complexity, and check against breached password lists if possible.
    • Multi-Factor Authentication (MFA): Highly recommended, especially for sensitive accounts or actions.
    • Secure Credential Storage: Never store plaintext passwords. Use strong, salted hashing algorithms.
    • Session Management: Securely manage user sessions, implement timeouts, and provide secure logout options.
    • Rate Limiting: Protect against brute-force login attempts.

  2. Authorization Mechanisms:

    • Principle of Least Privilege: Users should only have access to the data and functionalities necessary for their role or tasks.
    • Proper Entitlement Checks: Consistently verify user permissions before allowing access to resources or features.

Secure by Default Configuration​

Your app should be "made available on the market with a secure by default configuration" (Annex I, Part I, Point 2b). This can apply to authentication settings too. For example, prompting users to set up MFA during onboarding or having reasonable default security settings.

Third-Party Authentication Services​

If you use third-party services for authentication (e.g., Sign in with Google/Apple, Auth0), your due diligence obligations (Article 13, Paragraph 5) are critical:

  • Ensure secure integration (e.g., correct implementation of OAuth 2.0/OIDC flows).
  • Understand the security practices of the provider.
  • Manage client secrets and other credentials securely.

Vulnerability Handling​

If a vulnerability is discovered in your authentication or authorization logic, it needs to be addressed promptly as part of your vulnerability handling processes (Annex I, Part II).

Key Takeway​

The CRA mandates robust authentication and authorization in your app to prevent unauthorized access. Implement strong password policies, MFA, secure credential storage, and the principle of least privilege. If using third-party auth services, ensure secure integration and due diligence.