How do I implement user authentication securely?

Secure authentication practices:

1. Hash Passwords

Use bcrypt or Argon2 - never plain text.

2. Use Salt

Unique random salt for each password prevents rainbow attacks.

3. HTTPS Everywhere

Always encrypt credential transmission.

4. Rate Limiting

Limit login attempts to prevent brute force.

5. Secure Sessions

Random session IDs, HttpOnly cookies, timeouts.

6. Multi-Factor Auth

Add SMS codes or authenticator apps.

7. Input Validation

Protect against SQL injection and XSS.

8. Password Requirements

Minimum 8-12 chars, check against breached passwords.

9. Secure Reset

Time-limited tokens, verified emails only.

I am building a web application and need to implement user login and registration. What are the security best practices for implementing authentication to protect user accounts?