When building web applications for critical operations, security cannot be an afterthought. During my time at **CERT-In** (Indian Computer Emergency Response Team), I designed and deployed contact systems serving over 100 internal stakeholders, where securing sensitive credentials was a primary requirement.
Password Hashing with PBKDF2-SHA256
We implemented the robust **PBKDF2-SHA256** password hashing algorithm with a custom iteration count exceeding the default standard. This ensures that even if database records are compromised, the passwords remain highly resistant to offline brute-force attacks.
Multi-Factor Authentication
To further safeguard government stakeholder logins, we coupled basic email credentials with **Multi-Factor Authentication (MFA)**:
1. User logs in with password.
2. Verification code is dispatched dynamically via **Twilio SMS** API.
3. Login is completed only when the OTP validation block is satisfied.
Brute-Force Shieling
Using **Django Axes**, we set up request trackers that temporarily blacklist IP addresses exceeding five failed login attempts, rendering brute-force scanning ineffective.