Walk through a web login endpoint: credential checks, sessions and security

Explain, in as much detail as you can, how a login endpoint works. ```hint Follow one sign-in attempt Trace a single attempt from the moment the user submits the form until the client holds proof that it is signed in, and at each step ask what an attacker could try there. ``` ### Clarifying Questions - Are users signing in with an email and password for accounts we own, or should I also cover signing in through an outside identity provider such as a Google account? - Is the client a browser, a native mobile app, or both, since that changes how the signed-in state is stored? - Should I stay on the server mechanics and security, or also cover how we would measure whether sign-in is working well for users? ### What a Strong Answer Covers - The request and response contract: method, payload, status codes, and what the client holds after success - How passwords are stored and checked on the server, and why that method is chosen - How the signed-in state is represented, carried on later requests and ended - Attacks aimed at a login endpoint and the defense against each - The trade-off between security and sign-in friction, with the metrics a PM would watch ### Follow-up Questions - How does the flow change when users sign in with their Google account instead of a password? - Credential-stuffing traffic suddenly hits the endpoint. What would you notice in your metrics, and what would you change? - How would you let a user sign out of every device at once?