The SaaS auth checklist: 40 things to verify before you go to market

Auth is one of those areas where the gaps only become visible when something goes wrong — a breach, a security audit, or an enterprise customer's questionnaire that asks about capabilities you assumed were in place but never actually built. This checklist covers the 40 items we see most commonly missed or misconfigured on SaaS auth systems. Work through it before launch, before your first enterprise deal, and as a periodic review framework.

This list is not exhaustive — auth security is a moving target and new attack vectors emerge regularly. But completing every item here puts your auth system in a meaningfully better position than the majority of SaaS products at the same stage. The items under Session Management and Token Security are the most commonly missed. The items under SSO and GDPR are the most commonly discovered during enterprise sales due diligence. If you are working toward SOC 2 Type II, the Audit Logging section is where auditors spend the most time.

// Quick check: are your auth cookies set correctly?
// Run this in your browser console after logging in
document.cookie.split(';').forEach(c => {
  const [name] = c.trim().split('=');
  console.log(name, '— visible to JS (should be false for session cookies)');
});
// If your session cookie is visible here, you're missing HttpOnly