Application security through deceptive authentication

A system, comprising:

• a processor;
• and
• one or more computer-readable storage media storing computer-readable instructions that, when executed by the processor, perform operations comprising:
• at a proxy, receiving an enhanced authentication token for a session request for an application, the session request corresponding to an application account;
• decrypting encrypted information in the enhanced authentication token;
• and
• upon determining that the decrypted information indicates that the session request is malicious, establishing an application clone session in place of the requested session, wherein the application clone session includes at least some alternative data in place of data associated with the application account.

One or more computer-readable storage media storing computer-executable instructions for securing an application, the securing comprising:

• at an identity provider, receiving, from a web browser, a request for authentication of a user for a session with the application;
• comparing a submitted password for the request to a stored password associated with the user;
• comparing the submitted password to a group of false passwords associated with the user;
• upon determining that the submitted password matches one of the false passwords in the group, identifying the request as malicious and generating an enhanced authentication token, wherein:
• a signature of the enhanced authentication token is generated while the enhanced authentication token includes an attack indicator,
• the attack indicator is removed after the signature is generated, and
• the signature indicates establishment of an application clone session in place of the requested application session, where the application clone session includes at least some alternative data in place of data associated with the user;
• and
• transmitting the enhanced authentication token to the web browser.