Identification & Authentication

With neither Twotle nor Deposplit needing “typical” user accounts, this site does not cover them. Suffice to say that I would not implement user accounts myself anymore (even though I seem to have got them right with respect to password storage years before many major sites thanks to the first edition of Cryptography Engineering). Instead, I would leave identity management to the pros by falling back on an Identity as a Service (IDaaS) provider such as Zitadel, on an off-the-shelf Identity and Access Management (IAM) solution such as Keycloak, or on so-called social login (either directly or via Zitadel or Keycloak). If you still want to implement user accounts yourself, you should at the very least take advantage of a security library such as the Play version of pac4j.

To probe further, check Solving Identity Management in Modern Applications out. (If you understand German, you could also check Authentifizierung und Autorisierung out.)