2019-09-11：Your Node.js authentication tutorial is (probably) wrong.md

Your Node.js authentication tutorial is (probably) wrong

micaksica Aug 3, 2017

https://medium.com/hackernoon/your-node-js-authentication-tutorial-is-wrong-f1a3bf831a46

隨便紀錄吧，這篇先不花時間深入
也沒有太多實作內容能參考

Mistake one: credential storage

OWASP 建議 密碼應該

• 加 unique salt、加密
• Argon2 是最好的選擇

Mistake two: password reset

• 避免 Predictable tokens
  • Math.random() is predictable in V8, so it shouldn’t be used for token generation
• Bad storage 要確保 reset toke 別被隨便拿到
• No token expiry, reset toke 要有期限
• secondary data verification. 有第二個問題，會更有防護
  • https://www.kaspersky.com/blog/security-questions-are-insecure/13004/

Mistake three: API tokens

API 要做防護 例如

• JWT

Mistake four: rate limiting

避免「字點暴力破解」密碼