Attacks on what you send are half the story. The other half is who is allowed to do what.
Authentication
Also called authn, login
Proving who someone is: a password, a code from their phone, a passkey. The result is usually a session, so the server recognises them on every later request.
Login looks simple and is full of traps, from resets to session handling to error messages that reveal which accounts exist. When an agent offers to write it from scratch, the safer answer is usually an established library.
Say it to your agent
“Use the framework's session auth and don't write your own. Show the same error for a wrong password and an unknown email, require 15 characters with no composition rules, and rotate the session id at login.”