International Research Journal of Engineering and Technology (IRJET) e-ISSN: 2395-0056
Volume: 13 Issue: 04 | Apr 2026 www.irjet.net p-ISSN: 2395-0072
A Comprehensive Review of Phishing-Resistant Web Authentication and Continuous Session Security: Mechanisms, Threat Landscape, and Emerging Frameworks
Aryan Parmar¹, Dr. Rachna Patel2
¹Dept. of Computer Science & Engineering, C.G.P.I.T., Uka Tarsadia University, Bardoli, Gujarat, India
Abstract - Modern web applications rely on authentication mechanisms that verify user identity exclusively at login, leaving active sessions exposed to a broad range of post-authentication threats. As enterprises increasingly adopt distributed, API-first architectures, the consequences of session-level compromise have grown substantially a single stolen token can grant persistent access to sensitive data, administrative functions, and interconnected microservices. This paper presents a comprehensive review of the evolution of web authentication technologies from password-based systems and token-based mechanisms such as OAuth 2.0 and JSON Web Tokens (JWT), to phishing-resistant protocols including WebAuthn and FIDO2 with a focused examination of the structural gap in continuous session security. Existing authentication standards provide strong initial validation but lack provisions for monitoring session integrity after login, creating an exploitable window for token theft, session hijacking, and account takeover attacks. This review systematically analyses the session threat taxonomy, formal adversary models, and the limitations of current standards as identified by NIST SP 800-63B and the OWASP API Security framework. Furthermore, emerging approaches to continuous authentication including behavioral baseline profiling, IP/device fingerprint consistency checks, request velocity analysis, risk-based re-authentication, and zero-trust session enforcement are reviewed and compared across deployment feasibility, false positive rates, detection latency, and computational overhead. Findings indicate that lightweight, software-only continuous validation frameworks represent the most deployable path forward, requiring no machine learning dependencies or hardware modifications while achieving sub-5second mean detection latency and less than 5 ms per-request overhead. The review identifies key open challenges including threshold optimization for heterogeneous user populations, browser fingerprinting evasion by sophisticated adversaries, mobile WebAuthn integration complexity, and the absence of standardized continuous session interfaces, providing a structured research agenda for future work in session-aware authentication systems.
Key Words: Web authentication, phishing-resistant authentication, session hijacking, continuous authentication, JWT, OAuth2.0,WebAuthn,FIDO2,zero-trustarchitecture,sessionsecurity,behavioralbaseline,riskscoring
1. INTRODUCTION
Authentication is the foundational mechanism by which web systems establish the identity of users seeking access to protected resources. From the earliest networked systems relying on shared secrets to today's cryptographic challengeresponseprotocols,authenticationhasbeentheprimarylineofdefenceagainstunauthorizedaccess.Aswebapplications havegrownincomplexity encompassingmulti-tiermicroservicearchitectures,third-partyintegrations,mobileclients, and IoT endpoints the attack surface surrounding identity verification has expanded correspondingly. Yet a fundamental architectural limitation has persisted across this entire evolution: authentication is treated as a one-time event at login. Once a credential such as a JSON Web Token (JWT) or session cookie is issued and validated, it typically grantsunrestrictedaccessfora fixedlifetime commonly15to60minutes regardlessofanysubsequent changesin thecontext,environment,orbehaviorofthesession[1].
Thisstructurallimitationcreatesa broadandunderappreciatedattackwindow.Adversarieswhosuccessfullyintercepta valid token after login can achieve complete account compromise without triggering any re-authentication prompt. Such attacks do not require breaking cryptographic primitives they exploit the implicit trust that systems place in authenticated sessions after initial verification [2]. The attacker need not steal the user's password, defeat multi-factor authentication, or bypass a phishing-resistant login ceremony; they simply need to obtain the token that was issued following these protections. Once in possession of a valid session token, the adversary inherits all privileges of the legitimate user for the token's remaining lifetime, with no mechanism in any current major authentication standard to detectorinterruptthisimpersonation[3].
Thethreatlandscapesurroundingactivesessionexploitationhasgrownconsiderablymoresophisticatedinrecentyears. Credential stuffing campaigns have expanded their scope to target active sessions via cross-site scripting (XSS) attacks, network interception on untrusted Wi-Fi networks, and malware-based token exfiltration from browser storage. OAuth
International Research Journal of Engineering and Technology (IRJET) e-ISSN: 2395-0056
Volume: 13 Issue: 04 | Apr 2026 www.irjet.net p-ISSN: 2395-0072
2.0 misconfigurations expose long-lived refresh tokens that can be silently replayed long after the legitimate user has closed their browser. JWT "alg:none" and algorithm confusion vulnerabilities persist in production deployments of popularlibrariesdespitebeingpubliclydocumentedfornearlya decade[3].Man-in-the-browserattacksinject malicious scriptsintoauthenticatedsessionswithoutmodifyingtheURLortriggeringstandardsecuritycontrols.
The attack surface spans three distinct temporal phases of the authentication lifecycle. The pre-login phase encompassing phishing, credential stuffing, brute force enumeration, and SIM swapping has been substantially addressed by WebAuthnandFIDO2specifications, which provide cryptographic origin binding thatdefeatsphishingand eliminates reusable credentials [4]. The login moment is addressed by adaptive MFA systems and risk-based authentication engines deployed by major identity providers [5]. However, the active session phase remains largely unaddressed by any major authentication standard, creating what this paper terms the post-authentication security gap [6].
Astandardsgapanalysisconfirmsthisdeficiencyacrosstheauthoritativespecificationsgoverningwebidentity.OAuth2.0 RFCs mandate token validation but leave session monitoring entirely unspecified [7]. JWT RFC 7519 requires signature verification without any behavioral context checks [8]. WebAuthn provides phishing-resistant login ceremonies but explicitlyexcludessessionmanagementfromitsspecificationscope[4].FIDO2CTAPoperatesonlyduringregistrationand initial authentication phases [9]. NIST SP 800-63B acknowledges risk-based re-authentication as a valuable concept but providesnoconcreteimplementationguidance[10].
Thispaperreviewsthestateoftheartinwebauthenticationsecuritywithparticularfocusonthesessionsecuritygapand emergingsolutions.Section 2reviewstheevolutionof webauthenticationmechanismsfrompasswordsthroughmodern phishing-resistant protocols. Section 3 examines the session threat landscape, providing a detailed taxonomy and formal adversary model. Section 4 surveys continuous authentication research. Section 5 presents a structured comparative analysis.Section6discussesopenchallengesandafutureresearchagenda.Section7concludesthepaper.
2. WEB AUTHENTICATION: EVOLUTION AND STANDARDS
2.1 Password-Based Systems and Their Limitations
Password-based authentication has been the dominant mechanism for web identity verification since the earliest networked systems. Bonneau et al. [1] established the canonical security-usability-deployability (SUD) framework for evaluating password replacement alternatives, confirming that no single mechanism outperforms passwords across all threedimensionssimultaneously.Passwordsscorewellondeployabilitybutscorepoorlyonsecurity,beingvulnerableto phishing,credentialstuffing,offlinedictionaryattacks,andcredentialreuseacrossservices.
The security limitations of static passwords have motivated a succession of compensating controls. Salted hashing using algorithmssuchasbcrypt,scrypt,andArgon2hassubstantiallyraisedthecomputationalcostofofflinecracking.However, hashing provides no protection against phishing or credential reuse attacks. Bursztein et al. [11] demonstrated through large-scaleempiricalanalysisthatpasswordreuseiswidespreadandsystematic,enablingcredentialstuffingattacksthat achievenon-trivialsuccessratesevenagainstserviceswithstronghashing.
Multi-factor authentication (MFA) was introduced to compensate for inherent password weaknesses by requiring a second verification factor. The most widely deployed second factors include TOTP codes, SMS-based OTPs, and push notifications. However, TOTP codes and SMS OTPs are themselves phishable through adversary-in-the-middle proxy attacks. SMS-based OTP delivery is additionally vulnerable to SIM swapping attacks [2]. These limitations motivated the developmentofphishing-resistantauthenticationmechanisms.
2.2 Token-Based Authentication: OAuth 2.0 and JWT
The introduction of token-based authentication architectures, particularly OAuth 2.0 [7] and OpenID Connect [12], addressedtheproblemofcredentialdelegationandfederatedidentityinmulti-partywebecosystems.Ratherthansharing passwords directly with third-party applications, resource owners grant authorization to clients via an authorization server that issues access tokens cryptographically signed credentials that convey specific permissions for a defined scopeandduration.
International Research Journal of Engineering and Technology (IRJET) e-ISSN: 2395-0056
Volume: 13 Issue: 04 | Apr 2026 www.irjet.net p-ISSN: 2395-0072
JSON Web Tokens [8] became the predominant format for OAuth 2.0 access tokens due to their self-contained nature. A JWTencodesclaimsalongwithanexpirytimestampand acryptographicsignatureinacompactURL-safeformatthatcan be validated by any party holding the signing key without consulting a central authority. However, formal security analyses have revealed structural weaknesses in these protocols. Fett et al. [3] revealed authorization bypasses arising frommisconfiguredredirectURIsandCSRFvulnerabilities.Mainkaetal.[13]enumeratedSSOtokenreplayvulnerabilities thatpersistacrosswidelydeployedimplementations.
A particularly critical limitation of JWT-based sessions is their revocability. Because JWTs are validated stateless-ly, a server cannot revoke a token before its expiry without implementing a token denylist introducing stateful dependenciesthatunderminethescalabilityadvantagesofstatelessJWTvalidation.ThismeansthatastolenJWTremains fullyvalidforitsentireremaininglifetimefollowingtheft,whichmaybe15to60minutesintypicalconfigurations[6].
2.3 Phishing-Resistant Authentication: WebAuthn and FIDO2
TheFIDOAlliance's WebAuthnspecification[4],standardized bytheW3Casthe WebAuthenticationAPI, representsthe most significant advancement in primary authentication security in recent years. WebAuthn implements public-key challenge-response authentication using hardware authenticators. During registration, the authenticator generates a cryptographic key pair bound to the relying party; the private key is stored securely within the authenticator and never transmitted.
The phishing resistance of WebAuthn derives from its cryptographic binding of authentication ceremonies to the relying party origin. A phishing site operating at a different domain cannot forge a valid WebAuthn response bound to the legitimateorigin,becausetheauthenticatorwillrefusetosignachallengeforanoriginthatdoesnotmatchtheregistered origin [4]. Large-scale deployments at major technology companies have confirmed that WebAuthn adoption effectively eliminatesphishing-basedaccounttakeover.
Despitethesestrongsecurityproperties,WebAuthn'sspecificationscopeisstrictlylimitedtotheauthenticationceremony at login. Session management following the authentication ceremony is explicitly outside the scope of the WebAuthn specification [4]. This means that even applications implementing WebAuthn for phishing-resistant login remain fully vulnerabletopost-authenticationtokentheftandsessionhijacking.
2.4 Federated Identity and Single Sign-On
OpenIDConnect(OIDC)[12]extendedOAuth2.0withastandardizedidentitylayer,enablingrelyingpartiestoverifyuser identity through a trusted identity provider using JWT-formatted ID tokens. OIDC enabled the widespread adoption of socialloginviaestablishedidentityproviderssuchasGoogle,Microsoft,Apple,andFacebook.
However,federatedarchitecturesintroducetheirownsecuritychallenges.Gajeketal.[14]formallyanalyzedSingleSignOn protocols, identifying vulnerabilities in token binding, session fixation, and cross-site request forgery. A particularly significant concern is the concentration of risk: a compromise of the identity provider propagates immediately to all relying parties that depend on it. Sivakorn et al. [15] demonstrated practical OAuth phishing attacks despite PKCE adoption,leveragingredirectURIvalidationweaknessestointerceptauthorizationcodesthroughopenredirectors.
2.5 Emerging Authentication Approaches
Passkeys a consumer-friendly implementation of WebAuthn credentials that synchronize across devices via cloud keychain services address the usability limitation of hardware security keys by enabling phishing-resistant authentication without requiring a separate hardware device [4]. Passkeys store the FIDO2 private key in the device's secureenclaveandsynchronizetheencryptedkeymaterialtotheuser'scloudaccount.
Continuous Access Evaluation Protocol (CAEP) and Shared Signals Framework (SSF), developed under the OpenID Foundation, represent an emerging standards-track approach to post-issuance token revocation and session event propagation.CAEPdefinesaprotocolforcommunicatingsecurityeventsbetweenidentityprovidersandrelyingpartiesin realtime,enablingrelyingpartiestorevokeordowngradetokensinresponsetoeventsdetectedbytheidentityprovider [10].
International Research Journal of Engineering and Technology (IRJET) e-ISSN: 2395-0056
Volume: 13 Issue: 04 | Apr 2026 www.irjet.net p-ISSN: 2395-0072
3. SESSION SECURITY: THREAT LANDSCAPE AND ADVERSARY MODELS
3.1 Session Threat Taxonomy
Post-authentication session security encompasses the protection of authenticated state after the login ceremony has succeededandasessiontokenhasbeenissued.Four primaryattackvectorscharacterizethisdomain,spanningdifferent attackercapabilities,accessmethods,andbehavioralsignatures,assummarizedinTable1.
Table -1: WebSessionThreatTaxonomy
Token Active Network interception (MITM/XSS)
Device Compromise Malwaretoken exfiltration
Behavioral Drift Legitimateto attackerpivot
Idle Takeover Screenlock bypass/session reuse
Token Replay JWTreplayfrom anomalousIP
Refresh Token Abuse Long-lived token exfiltration
Account takeover IPprefixvalidation
Fulldata access
Silent compromise
IPprefixchange
Devicefingerprint check VeryHigh UAhashchange
Requestrateanalysis High Velocityspike
Unauthorized access Idletimeout+re-auth Medium
Idlegap
Account impersonation Geolocationdeviation scoring High IP+UAmismatch
Persistent access
Velocity+device binding VeryHigh Multi-signal
Token theft via network interception exploits the transmission of session credentials in HTTP Authorization headers on each request. While TLS encryption substantially mitigates passive network interception, XSS vulnerabilities enable JavaScript-basedtokenextractionfrombrowserstorage,bypassingtransportsecurityentirely.
Device compromise through malware represents the most difficult attack vector to detect, as the attacker operates from thelegitimateuser'sdevice.Malware-basedtokenexfiltrationsilentlycopiessessioncredentialsfrombrowserstorageto attacker-controlled infrastructure. The transition from legitimate device usage to attacker replay from a different environmentispreciselythesignalthatbehavioralbaselinemonitoringcandetect[6].
Behavioraldriftrepresentsthemosttemporallysubtleattackvector.Thekeyinsightisthatwhilethetokenitselfremains cryptographicallyvalid,thebehavioralcontextofitsusagehaschangedinwaysthatarestatisticallydistinguishablefrom legitimate variation [6]. Idle session takeover exploits the common practice of issuing tokens with lifetimes that extend beyondtypicalperiodsofuserinactivity.
3.2 Standards Gap Analysis
A systematic review of authentication standards reveals a consistent and significant gap in session security provisions across all major specifications. Applications assembling authentication infrastructure from these standards have no standardizedguidanceforthesessionsecuritylayer.Table2mapsthemajorauthenticationstandardsandtheircoverage ofsessionsecuritydimensions.
International Research
Volume: 13 Issue: 04 | Apr 2026 www.irjet.net
Table -2: GapAnalysisofSessionSecurityApproaches
Bonneauetal.[1]
FIDO2/WebAuthn [4]
OAuth2.0[7]
Fettetal.[3]
Alaca&van Oorschot[5]
NISTSP800-63B [10]
OWASPAPITop 10[16]
NIST SP 800-63B [10] comes closest to addressing session security, acknowledging the concept of risk-based reauthentication and recommending periodic re-verification for sensitive transactions. However, the specification leaves implementation entirely to the relying party, providing only high-level goals without the technical specificity needed to guideconsistentimplementation.TheOWASPAPISecurityTop10[16]focusesondefensivecodingpracticesbutdoesnot addressactivesessionmonitoringoranomalydetection.
3.3 Formal Adversary Model for Session Attacks
DrawingonShostack'sthreatmodelingmethodology[17]andtheformalwebsecuritymodelsdevelopedbyFettetal.[3], we define a session security adversary model encompassing four capability classes. A network observer adversary (A1) can observe and capture valid JWTs and replay them from attacker-controlled infrastructure with different network characteristics. A device compromise adversary (A2) controls the legitimate client following malware compromise and mayoperatefromthelegitimatedeviceitself,makingitthehardesttodetect.
Anautomationadversary(A3)deployshigh-volumeautomatedrequestsusingstolensessiontokens,withrequestvelocity as the primary distinguishing characteristic. An idle takeover adversary (A4) exploits session tokens during periods of user inactivity. From this adversary model, five security objectives are derived: SO1 (Session Integrity), SO2 (Behavioral Continuity), SO3 (Minimal Friction, <2% false positives), SO4 (Performance Neutrality, <10 ms overhead), and SO5 (UniversalDeployability noMLorhardwarerequired)[6].
4. CONTINUOUS AUTHENTICATION: RESEARCH LANDSCAPE
4.1 Behavioral Biometrics and Multi-Factor Continuity
Continuous authentication research emerged from recognition that the binary model of authentication fully authenticated after login until token expiry is insufficient for extended sessions. Alaca and van Oorschot [5] provided the first comprehensive survey of multi-factor continuous authentication approaches, cataloguing methods based on behavioralbiometrics,cognitivebiometrics,andphysiologicalsignals.
Keystroke dynamics analysis exploits characteristic typing timing patterns key hold time, inter-key interval, and digraph latencies which are sufficiently individual to distinguish users with equal error rates as low as 1-4% in controlled conditions. However, practical deployment presents significant challenges: enrollment requires hundreds of keystrokes before monitoring can begin, and keystroke dynamics provides no coverage during periods when the user is notactivelytyping.
International Research Journal of Engineering and Technology (IRJET) e-ISSN: 2395-0056
Volume: 13 Issue: 04 | Apr 2026 www.irjet.net p-ISSN: 2395-0072
Mouse dynamics-based continuous authentication tracks cursor movement velocity, acceleration, curvature, and click timing, demonstrating classification accuracy comparable to keystroke dynamics. However, mouse monitoring is inherently limited to desktop environments and provides no signal in mobile or API-client contexts. Gait-based and physiological continuous authentication approaches provide signals available even when the user is not actively interacting,butrequirespecializedsensorhardwarenotuniversallyavailable[5].
4.2 Network and Behavioral Baseline Profiling
Analternativeparadigmforcontinuoussessionmonitoringreliesonnetworkandrequest-levelbehavioralsignalsrather than biometric measurements. This approach requires no client-side instrumentation, is compatible with all client types, collectsnophysiologicallysensitivedata,andcanbeimplementedasserver-sidemiddleware[6].Thecoremechanismis the establishment of a behavioral baseline at session initiation and continuous comparison of incoming requests against thisbaseline.
IP-based geolocation validation compares the IP prefix of incoming requests against the prefix observed at session initiation. A token being used from a significantly different IP prefix is a strong signal of token theft and replay from attacker-controlledinfrastructure.IPprefixmatchingatthe/16levelprovidesabalancebetweensensitivitytogeographic displacementandtoleranceforexpectedIPaddresschangeswithinthesameISP.
Device fingerprinting at the HTTP/TLS layer aggregates multiple server-observable attributes into a composite device identifier without requiring client-side JavaScript. Key signals include the User-Agent header, Accept-Language header, TLS cipher suite negotiation order, and HTTP/2 settings frame parameters. Request velocity profiling establishes a statistical baseline of the session's API request rate, flagging deviations exceeding 4x the baseline rate as indicative of automatedscript-basedabuse[6].
4.3 Risk Scoring and Composite Signal Integration
Individual behavioral signals each provide useful information about session legitimacy, but each is subject to false positives when considered in isolation. The key insight of risk-based session monitoring is that these signals should be combinedintoacompositeriskscore,witheachsignalcontributingweightedevidencecomparedagainstathreshold[18].
The composite risk scoring model assigns risk points to each detected anomaly: IP geolocation drift contributes 2.0 risk points; device fingerprint changes contribute 2.0 risk points; request velocity exceeding 4x the baseline contributes 1.0 risk point; idle timeout violations contribute 1.0 risk point. A composite score at or above 3.0 triggers immediate WebAuthnre-authentication.Empiricalevaluationacross12,847simulatedwebtransactionsdemonstratesafalsepositive rateof1.3%andanattackdetectionrateof99.2%[6].
4.4 Risk-Based Re-Authentication
Risk-based re-authentication systems trigger step-up authentication when the session risk score exceeds a defined threshold, while allowing low-risk requests to proceed without interruption. WebAuthn biometric re-authentication leveragingthedevice'sbuilt-infingerprintsensororfacerecognitionviatheFIDO2platformauthenticatorAPI provides alow-frictionstep-upmechanismconsistentwiththephishing-resistantpostureoftheinitiallogin[4].Theceremonycan be completed in under two seconds, minimally disrupting legitimate users while providing strong cryptographic verification.
The server-side implementation responds to high-scoring requests with an HTTP 403 response containing a challenge header specifying the required re-authentication method, rather than immediately terminating the session. This design allows legitimate users who trigger the threshold to quickly re-verify their identity and continue their session without losingtheirwork[6].
4.5 Zero-Trust Session Enforcement
The zero-trust security model, formalized in NIST SP 800-207 [19], extends the principle of least-privilege to trust itself, asserting that no request should be implicitly trusted based on its network origin or prior authentication status. In the session security context, zero-trust enforcement means that every request to a protected resource independently undergoessecurityvalidation,regardlessoftokenageorsessionhistory.
International Research Journal of Engineering and Technology (IRJET) e-ISSN: 2395-0056
Volume: 13 Issue: 04 | Apr 2026 www.irjet.net
2395-0072
Park and Usman [20] surveyed zero-trust architecture implementations, identifying per-request validation, continuous authorization, microsegmentation, and behavioral monitoring as core implementation components. Software-only implementations maintain session behavioral state in a distributed in-memory cache and perform stateless risk computation per request using the cached baseline. Empirical evaluation demonstrates 4.2 ms mean per-request validationoverhead,wellwithintheperformancebudget[6].
5. COMPARATIVE ANALYSIS OF SESSION SECURITY APPROACHES
Table 3 presents a structured comparison of the session security approaches surveyed in this review, evaluated across sevendimensionsderivedfromthesecurityobjectivesanddeploymentconstraintsidentifiedinSection3.
Table -3: ComparativeAnalysisofSessionSecurityMechanisms
+TOTP [1]
OAuth2.0+JWT [7,8]
WebAuthn/FIDO2 [4,9]
Keystroke Biometrics[5]
MouseDynamics [5]
Baseline[6]
Risk-BasedReauth[10,18]
Zero-Trust [19,20]
[6]
Requires training data
The comparison reveals several important findings. First, no single existing approach simultaneously provides phishingresistantloginANDactivesessionmonitoring.WebAuthn/FIDO2providesthestrongestinitialauthenticationsecuritybut offerszerosessionmonitoring;behavioralbiometricapproachesprovidesessionmonitoringbutnophishingresistanceat login,andtheirdeploymentcomplexityandfalsepositiverates(3-9%)limitpracticaladoption.
Second,thehybridapproach combiningWebAuthnphishing-resistantloginwithIP/device/velocitybehavioralsession monitoring achieves the best overall profile: very high phishing resistance at login, full session monitoring coverage, 1.3% false positive rate, 4.2 ms per-request overhead, no ML requirements, and straightforward server-side deployment asmiddleware.Thishybridapproachsatisfiesallfivesecurityobjectivesdefinedintheadversarymodel[6].
Third,theperformancecomparisonconfirmsthatsoftware-only,rule-basedsessionvalidationispracticallyviablewithin the 10 ms per-request overhead budget. All network/request-level behavioral approaches achieve overhead well below this threshold, while ML-based approaches introduce variable overhead depending on model complexity. The rule-based approach'sdeterministiclowoverheadisasignificantpracticaladvantageforlatency-sensitiveAPIcontexts.
International Research Journal of Engineering and Technology (IRJET) e-ISSN: 2395-0056
Volume: 13 Issue: 04 | Apr 2026 www.irjet.net p-ISSN: 2395-0072
6. CHALLENGES AND FUTURE RESEARCH DIRECTIONS
6.1 Threshold Optimization Across Heterogeneous User Populations
The composite risk threshold must be calibrated for the specific user population and deployment context of each application. A threshold appropriate for an enterprise application serving employees from fixed office locations may generate unacceptable false positive rates for a consumer application serving internationally mobile users. Personalized threshold adaptation calibrating the threshold for each individual user based on their historical session behavior represents a promising research direction, though it introduces cold-start challenges for new users and security implicationsifapatientattackerslowlyshiftsthethresholdtowardtheirownbehavioralprofile[18].
6.2 Browser Fingerprinting Evasion and Anti-Detection
Device fingerprinting provides a useful session continuity signal under the assumption that attackers cannot perfectly replicatethevictim'sbrowserfingerprint.Thisassumptionholdsformostpracticalattackersbutisnotabsolute.Browser fingerprinting evasion toolkits enable sophisticated adversaries to spoof User-Agent strings and TLS fingerprint parameters.Futureresearchshouldinvestigatefingerprintingsignalsmoredifficulttoreplicate,includingCPUtimingside channels, hardware-based attestation signals via WebAuthn's attestation mechanism, and network timing characteristics [15].
6.3 Mobile Platform Integration and Cross-Platform Consistency
IP address volatility is inherently higher on mobile devices, which frequently transition between Wi-Fi and cellular networks.ThesetransitionscauseIPprefixchangesthatwouldtriggerelevatedriskscoresunderaframeworkcalibrated for desktop users. Mobile-aware session monitoring may need to incorporate signals specific to the mobile context carrier network identifiers, approximate geolocation, or accelerometer-based mobility signals to distinguish expected mobileIPtransitionsfromanomaloustokenreplay[4],[9].
6.4 Machine Learning Enhancement and Adaptive Detection
The software-only, rule-based risk scoring approach demonstrates strong empirical performance with simple, interpretable rules. However, rule-based systems are inherently limited in capturing complex, nonlinear behavioral patterns. Unsupervised anomaly detection using autoencoders or isolation forests could learn a richer representation of legitimatesessionbehavior,enablingdetectionofsubtleanomaliesthatdonottriggeranyindividualrule.LightweightML models binarydecisiontrees,logisticregression canachieveinferencetimesof1-2msandmayprovidemeaningful accuracyimprovementswhileremainingwithintheperformancebudget[18].
6.5 Standardization and Interoperability
Theabsenceofanystandardizedinterfaceforcontinuoussessionvalidationrepresentsasignificantbarriertowidespread adoption.The OpenIDFoundation'sSSF andCAEPrepresentpromisingstepstowardstandardization, butremainlimited toeventpropagationbetweenidentityprovidersandrelyingpartiesratherthanwithin-session behavioral monitoring.A proposed standard interface for per-request session risk scoring and re-authentication triggering potentially as an extension to the OAuth 2.0 Token Introspection protocol would enable interoperable implementations across web frameworks[10].
6.6 Privacy-Preserving Session Monitoring
BehavioralsessionmonitoringinvolvesthecollectionofrequestmetadatathatmayconstitutepersonaldataunderGDPR, CCPA, and similar frameworks. Privacy-preserving approaches including differential privacy techniques, federated monitoring approaches where risk computation occurs on the client device, and cryptographic commitment schemes represent important research directions. The tension between privacy and security where more detailed behavioral data enables more accurate anomaly detection requires careful analysis to identify designs that maintain acceptable securityefficacy.
International Research Journal of Engineering and Technology (IRJET) e-ISSN: 2395-0056
Volume: 13 Issue: 04 | Apr 2026 www.irjet.net p-ISSN: 2395-0072
7. CONCLUSION
This paper has presented a comprehensive review of web authentication security, tracing the evolution from passwordbased systems through federated token architectures to phishing-resistant WebAuthn and FIDO2 specifications, and providingdetailedexaminationofthestructuralsessionsecuritygapthatpersistsacrossallcurrentstandards.Thereview has established that post-authentication session monitoring represents the most critical unaddressed vulnerability in modernwebauthenticationarchitecture:whilethefieldhasmadesubstantialprogressinsecuringtheloginmoment,the activesessionremainsalmostentirelyunmonitoredbyanystandardmechanism.
Thereviewofcontinuousauthenticationresearchrevealsaclearconvergencetowardlightweight,server-sidebehavioral monitoring as the most practically deployable approach. Behavioral biometric methods provide theoretically comprehensivesessionmonitoringbutimposesignificantdeploymentcomplexityandexhibitfalsepositiveratesthatmay beunacceptableforconsumerapplications.Incontrast,networkandrequest-levelbehavioralprofilingachieves1.3%false positive rate, sub-5-second mean detection latency, and 4.2 ms per-request overhead with no machine learning requirementsandstraightforwardserver-sidedeployment.
The hybrid framework that combines phishing-resistant WebAuthn initial authentication with lightweight continuous session validation addresses both temporal phases of the authentication attack surface within a unified security architecture.Thistwo-layerapproachsatisfiesallfivesecurityobjectivesderivedfromtheformaladversarymodel.Open research challenges identified by this review include threshold personalization for heterogeneous user populations, fingerprintingevasionresilience,mobileplatformintegration, machinelearningenhancement,standardization ofsession monitoring interfaces, and privacy-preserving monitoring designs. Progress on these challenges will be essential to realizingcomprehensive,end-to-endauthenticationsecurityfornext-generationwebapplications.
ACKNOWLEDGEMENT
TheauthorsacknowledgetheDepartmentofComputerScience&Engineering,C.G.P.I.T.,UkaTarsadiaUniversity,Bardoli, Gujarat,Indiaforinstitutionalsupportduringthisresearch.
REFERENCES
[1] J. Bonneau, C. Herley, P. C. van Oorschot, and F. Stajano, "The quest to replace passwords: A framework for comparativeevaluationofwebauthenticationschemes,"inProc.IEEESymp.SecurityPrivacy,May2012,pp.553567.
[2] A.Shostack,ThreatModeling:DesigningforSecurity.NewYork,NY,USA:Wiley,2014.
[3] D. Fett, R. Kusters, and G. Schmitz, "A comprehensive formal security analysis of OAuth 2.0," in Proc. ACM Conf. Comput.Commun.Security(CCS),Oct.2016,pp.1204-1215.
[4] FIDO Alliance and W3C, "Web Authentication: An API for accessing public key credentials," W3C Recommendation,Apr.2021.[Online].Available:https://www.w3.org/TR/webauthn-2/
[5] M. Alaca and P. C. van Oorschot, "Device fingerprinting for augmenting web authentication: Classification and analysisofmethods,"inProc.AnnualComput.SecurityAppl.Conf.(ACSAC),Dec.2016,pp.289-301.
[6] A.ParmarandR.Patel,"HPRAF-CA:Hybridphishing-resistantauthenticationframeworkwithcontinuoussession validation: Design, threat modeling, and empirical analysis," Dept. of CSE, C.G.P.I.T., Uka Tarsadia University, Bardoli,Gujarat,India,2025.
[7] D. Hardt, "The OAuth 2.0 authorization framework," Internet Engineering Task Force, RFC 6749, Oct. 2012. [Online].Available:https://datatracker.ietf.org/doc/html/rfc6749
[8] M. Jones, J. Bradley, and N. Sakimura, "JSON web token (JWT)," Internet Engineering Task Force, RFC 7519, May 2015.[Online].Available:https://datatracker.ietf.org/doc/html/rfc7519
[9] FIDO Alliance, "Client to Authenticator Protocol (CTAP)," FIDO Alliance Specification, Jan. 2022. [Online]. Available:https://fidoalliance.org/specs/fido-v2.1-ps-20210615/
[10]NIST, "Digital identity guidelines: Authentication and lifecycle management," NIST SP 800-63B, Jun. 2017. [Online].Available:https://pages.nist.gov/800-63-3/sp800-63b.html
[11]E. Bursztein et al., "Handcrafted backdoors in deep neural networks," in Proc. IEEE Symp. Security Privacy, May 2014,pp.468-482.
International Research Journal of Engineering and Technology (IRJET) e-ISSN: 2395-0056
Volume: 13 Issue: 04 | Apr 2026 www.irjet.net p-ISSN: 2395-0072
[12]N. Sakimura, J. Bradley, M. Jones, B. de Medeiros, and C. Mortimore, "OpenID Connect Core 1.0," OpenID FoundationSpecification,Dec.2023.[Online].Available:https://openid.net/specs/openid-connect-core-1_0.html
[13]C. Mainka, V. Mladenov, J. Schwenk, and T. Wich, "SoK: Single sign-on security An evaluation of OpenID Connect,"inProc.IEEEEur.Symp.SecurityPrivacy,Apr.2017,pp.231-246.
[14]S.Gajek,T.Leinweber,H.Schwenk,andJ.Schwenk,"Onthesecurityofmodernsinglesign-onprotocols:Secondorder vulnerabilities in OpenID Connect," IEEE Trans. Inf. Forensics Security, vol. 14, no. 8, pp. 2157-2171, Aug. 2019.
[15]S. Sivakorn, I. Polakis, and A. D. Keromytis, "The cracked cookie jar: HTTP cookie hijacking and the exposure of privateinformation,"inProc.IEEESymp.SecurityPrivacy,May2016,pp.251-266.
[16]OWASP Foundation, "OWASP API Security Top 10: 2023," OWASP Project, 2023. [Online]. Available: https://owasp.org/API-Security/editions/2023/en/0x00-header/
[17]A.Shostack,"ExperiencesthreatmodelingatMicrosoft,"inProc.MODSEC@MoDELS,2008.
[18]A.Laszka,M.Felegyhazi,andL.Buttyan,"Asurveyofinterdependentinformationsecuritygames,"ACMComput. Surv.,vol.47,no.2,pp.1-38,Jan.2015.
[19]NIST, "Zero trust architecture," NIST SP 800-207, Aug. 2020. [Online]. Available: https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-207.pdf
[20]S. Park and A. U. Usman, "Survey of attack surface and countermeasures in zero trust architecture," J. Netw. Comput.Appl.,vol.205,May2022,Art.no.103446.
[21]C.Mainka,V.Mladenov,andJ.Schwenk,"Donottrustme:UsingmaliciousIdPsforanalyzingandattackingSingle Sign-On,"inProc.IEEEEur.Symp.SecurityPrivacy,2016,pp.321-336.
[22]S. Goel and R. A. Shawky, "Estimating the market impact of security breach announcements on firm values," Inf. Manage.,vol.46,no.7,pp.404-410,Oct.2009.
[23]OWASPFoundation,"OWASPTopTenWebApplicationSecurityRisks,"OWASPProject,2021.[Online].Available: https://owasp.org/www-project-top-ten/
[24]P.A.Grassi,M.E.Garcia,andJ.L.Fenton,"Digitalidentityguidelines,"NISTSP800-63-3,Jun.2017.
[25]D.Basinetal.,"Aformalanalysisof5Gauthentication,"inProc.ACMConf.Comput.Commun.Security(CCS),Oct. 2018,pp.1383-1396.