I've read a hundred 'add login' PRs from side projects. They all break the same way.

Problem

Side projects almost always ship auth that works, until it’s tested by anything other than the happy path. Password reset links that can be reused, sessions that stay valid after a password change, login endpoints with no rate limit.

Why it happens

Auth feels “solved” the moment login and signup work, so most people stop there. Nobody deliberately skips session lifecycle and revocation; they just never think about it, because the tutorial they followed didn’t either.

Better approach

Stop thinking of auth as a login form. Think of it as an identity and session lifecycle:

• Reset tokens are single-use and expire in minutes, not days
• Sessions invalidate the moment a password changes
• Login attempts are rate-limited per account and per IP
• Tokens rotate on privilege changes, not just on expiry

Example

A password reset link that works the moment it’s sent, and still works if you click it again next week, because nothing marked it as used. One screenshot in an old email thread is all it takes.