Ask HN: What are all the things that can go wrong during authentication?

Trying to build a bulletproof drop-in authentication system. What are all the things that could go wrong with authentication?

And I mean SSO, persistence, cookies, hashes, network dropouts, OAuth, etc. Curious to get y'alls take on it!