Authentication & Session Security
High-level overview of blackLen's authentication architecture, JWT session lifecycles, MFA verification, and cross-tab synchronization.
blackLen implements an authentication and session management architecture engineered for security, high availability, and consistent multi-tab operator experience.
Stateless JWT & Token Lifecycle
Authentication in blackLen is built on JSON Web Tokens (JWT):
- Access Tokens: Short-lived cryptographically signed tokens containing user identity and clearance scopes. Passed in the
Authorization: Bearer <token>header for authenticated API calls. - Refresh Tokens: Long-lived tokens maintained in client storage to request fresh access tokens during active work sessions without disrupting operator focus.
- Session Revocation: Operators can terminate active sessions or log out from devices, invalidating active refresh credentials.
Multi-Factor Authentication (MFA)
To protect sensitive engagement workspaces and client target scopes, blackLen supports two robust MFA channels:
- Time-Based One-Time Passwords (TOTP): Compatible with standard authenticator applications (e.g., Google Authenticator, Authy, 1Password, Bitwarden) using RFC 6238 standards.
- Email OTP Verification: Secure 6-digit challenge codes dispatched to verified account email addresses with strict time-to-live (TTL) expiration.
MFA challenges are enforced at the gateway before any access tokens are minted. Failed verification attempts automatically trigger challenge invalidation.
Cross-Tab Session Synchronization
In intensive penetration testing workflows, security operators frequently work across multiple browser tabs (e.g., monitoring checklist progress in one tab, editing Python scripts in another, and reviewing payload parameters in a third).
To prevent multi-tab token collision:
- Single-Flight Refresh: When an access token expires, the client coordinates token refresh across all active browser tabs.
- Atomic State Sync: Fresh credentials are synchronized across tabs, ensuring uninterrupted testing workflows without unexpected logouts or HTTP 401 interruptions.
Password Security & Hashing
User account passwords are protected using industry-standard PBKDF2 with SHA-256 key derivation with high iteration counts to resist offline dictionary and brute-force attacks.