Does Copilot handle authentication correctly?

Copilot often generates authentication code with subtle security flaws. Common issues include missing CSRF protection, improper session management, insecure token storage in localStorage instead of httpOnly cookies, weak password validation, and missing brute-force protection. Copilot may suggest outdated authentication patterns like rolling your own JWT verification instead of using established libraries. Authentication is one of the most security-sensitive areas of any application, and AI-generated auth code should receive the most scrutiny. UNPWNED tests authentication endpoints for common weaknesses including missing rate limiting and insecure session handling.