EXERCISE 2 — "Weakest path" and how A07 interlocks with A01/A02/A03/A05
=======================================================================

WHY "AUTHENTICATION IS ONLY AS STRONG AS ITS WEAKEST PATH" (recovery example):
  - An attacker chooses the EASIEST way in, not the hardest. So your security is
    set by the WEAKEST authentication path you offer, not the strongest.
  - RECOVERY EXAMPLE: suppose login uses passkeys + MFA (phishing-resistant,
    excellent). But "forgot password / lost device" falls back to an SMS code or
    a security question. The attacker IGNORES the strong front door and attacks
    recovery:
      * SIM-swap the phone number -> receive the SMS reset code -> take over;
      * or look up the security-question answer (mother's maiden name) online.
    The strong MFA is irrelevant — the account is taken via the weak side door.
    This is why RECOVERY is the #1 account-takeover vector and must be as strong
    as login (single-use expiring hashed tokens, re-auth, no SMS/security
    questions for high-value accounts). A07 is a SYSTEM property: every stage —
    storage, login, session, MFA, recovery — must hold.

HOW A07 INTERLOCKS WITH OTHER CATEGORIES (one concrete way each):

  A01 — BROKEN ACCESS CONTROL (authorization):
    - Authentication establishes WHO you are; authorization decides WHAT you may
      do. If access control is broken (e.g. an IDOR or a missing admin check),
      an authenticated low-priv user reaches another user's data or admin
      functions — undermining the value of authenticating correctly. (And
      tampering a role/JWT claim to "admin" sits on the A01/A07 boundary.)
      Conversely, auth failures grant the identity that authz then trusts.

  A02 — CRYPTOGRAPHIC FAILURES:
    - Authentication DEPENDS on cryptography done right. Weak password hashing
      (fast/unsalted) or storing passwords "encrypted" (A02) means a breach
      yields plaintext credentials -> mass account takeover. Likewise weak
      randomness (non-CSPRNG) makes session IDs/reset tokens guessable. A02 done
      wrong directly breaks A07's storage and token stages.

  A03 — INJECTION (incl. XSS):
    - XSS (now part of A03) can STEAL or RIDE the session: an injected script
      reads a non-HttpOnly session cookie, or makes same-origin requests in the
      victim's session, achieving account takeover with no credential. This is
      why "fix XSS first" recurs — an XSS hole defeats otherwise-strong
      authentication by stealing the session it produced. (SQL injection can
      also bypass login via ' OR '1'='1.)

  A05 — SECURITY MISCONFIGURATION:
    - DEFAULT/UNCHANGED CREDENTIALS (admin/admin) are a misconfiguration that is
      simultaneously an instant authentication bypass — internet-scanned and
      breached in minutes. Also: debug mode/verbose errors leaking auth secrets,
      or missing Secure/HttpOnly/SameSite cookie flags (a config omission) that
      expose the session. Misconfiguration repeatedly hands attackers the
      authentication win.

THE THROUGH-LINE:
  A07 doesn't stand alone. The credential it protects can be exposed by bad
  crypto (A02), stolen by injection/XSS (A03), handed over by misconfiguration
  (A05), and rendered moot by broken authorization (A01) — and within A07
  itself, the weakest stage (often recovery) sets the bar. Account security =
  the weakest link across all of these, which is exactly the Auth course's
  closing message at Top 10 scale.