authentication system requirements for a stand alone web app

Question

What should my authentication requirements be for a stand alone web application that will not integrate with any other applications? I know that I will need to have the following features, but am I missing anything?

• unattended password reset
• lock account after multiple failed login attempts
• roles for different kinds of users
• log all login attempts
• integrate with htaccess file and deny authorization to a given directory if login attempt is not successful

Answer 1

Other than configuring the firewall to ban a users IP after multiple failed login attempts to prevent brute force attacks and
enforce password management (apply basic password management rules, such as password length, history, complexity and mandate that all users change their passwords regularly) your lists seems quite solid.