OWASP Authentication Cheat Sheets

Official docs outline

Authentication
Login design, generic error messages, password policy, account lockout and authentication flows.
Multifactor Authentication
MFA factors, phishing-resistant methods, fallback and enrollment.
Forgot Password
Reset token design, enumeration-safe responses and recovery flows.
Credential Stuffing Prevention
Rate limiting, breached-password checks, device fingerprinting and bot defenses.
Choosing and Using Security Questions
Knowledge-based recovery questions and their weaknesses.
OAuth2
Authorization code flow with PKCE, redirect URI validation, scopes and token handling.
SAML Security
Signature validation, assertion handling, XML signature wrapping and replay protection.
JSON Web Token
JWT algorithm pinning, signature verification, expiry and token storage.
Passkey Security
WebAuthn passkeys, attestation, recovery and registration security.
Transaction Authorization
Authorizing sensitive transactions and defeating man-in-the-middle manipulation.

Each section links to the official page. Titles and summaries by Extra Credit; the docs belong to their authors.