Authentication
Athena UI includes static screens for sign in, sign up, MFA, recovery codes, reset passphrase, invite acceptance, lock screen, disabled accounts, email verification, and session expiry. The template shows the frontend shape; real authentication and authorisation must be enforced server-side.
Credential Screens
Use labelled email and passphrase inputs with autocomplete, validation summaries, password visibility controls, and rate-limited backend submission.
MFA And Recovery
The MFA and recovery-code pages provide clear labels, single-purpose actions, and language that separates passphrases from one-time codes.
Session States
Lock screen, session expired, and disabled-account pages provide distinct user recovery paths without exposing sensitive account details.
Backend Ownership
Implement secure cookies, CSRF protection, session rotation, MFA policy, role checks, account lockout, and audit logging in the application backend.
OWASP Notes
- Never trust hidden fields or frontend roles for authorisation decisions.
- Protect authentication routes with rate limiting, generic failure messages, and monitored audit events.
- Store secrets only server-side and keep tokens out of local storage.