Authentication Best Practices

Easy•

Authentication is fundamental to web security. Following best practices prevents common vulnerabilities and ensures user data protection.

Quick Navigation: Understanding Authentication Flow • Password Security • Session Management • Authentication Methods Comparison • Best Practices for Implementation

Quick Decision Guide

Quick Implementation Guide:

Password Hashing: Use bcrypt: const hash = await bcrypt.hash(password, 10). Never store plain passwords.

JWT Tokens: Use for stateless auth: jwt.sign({ userId }, SECRET, { expiresIn: '24h' }). Store in httpOnly cookie or localStorage (less secure).

Sessions: Use secure, httpOnly cookies: cookie: { secure: true, httpOnly: true, sameSite: 'strict' }

Rate Limiting: Prevent brute force: rateLimit({ windowMs: 15<em>60</em>1000, max: 5 }) on login endpoints.

Password Requirements: Minimum 8 chars, require complexity, check against common passwords list.

Security Checklist: - ✅ Hash passwords with salt (bcrypt/Argon2) - ✅ Use HTTPS only - ✅ HttpOnly cookies for sessions - ✅ Rate limit login attempts - ✅ Regenerate session ID after login - ✅ Set token expiration (24h max for JWTs)

Never: Store plain passwords, trust client validation, or put tokens in URLs.

Understanding Authentication Flow

Overview of Authentication

Authentication verifies who a user is. It's the process of confirming a user's identity before granting access to protected resources.

Figure 1: Authentication Flow

┌─────────────┐         ┌──────────────┐         ┌─────────────┐
│   User      │         │   Server     │         │   Database   │
│  Browser    │         │              │         │              │
└──────┬──────┘         └──────┬───────┘         └──────┬──────┘
       │                       │                        │
       │ 1. Submit Credentials │                        │
       │    (username/password)│                        │
       ├───────────────────────>                        │
       │                       │                        │
       │                       │ 2. Query User         │
       │                       ├────────────────────────>
       │                       │                        │
       │                       │ <───────────────────────
       │                       │    User Record        │
       │                       │                        │
       │                       │ 3. Verify Password    │
       │                       │    (compare hash)     │
       │                       │                        │
       │                       │                        │
       │                       │ 4. Generate Token/    │
       │                       │    Session            │
       │                       │                        │
       │ <───────────────────────                        │
       │    Token/Session      │                        │
       │                       │                        │
       │ 5. Store Token        │                        │
       │    (cookie/localStorage)│                        │
       │                       │                        │

Authentication Methods

1. Password-Based Authentication

•Most common method

•Username + password combination

•Requires secure password storage

2. Token-Based Authentication (JWT)

•Stateless authentication

•Token contains user claims

•No server-side session storage needed

3. OAuth 2.0

•Third-party authentication

•Delegated authorization

•Used by Google, GitHub, etc.

4. Multi-Factor Authentication (MFA)

•Multiple verification factors

•Something you know (password)

•Something you have (phone, hardware token)

•Something you are (biometric)

Password Security

Never Store Plain Text Passwords

Figure 2: Password Storage Comparison

┌─────────────────────────────────────────────────────────┐
│              Password Storage Methods                    │
├─────────────────────────────────────────────────────────┤
│                                                          │
│  ❌ Plain Text (DANGEROUS)                              │
│  ┌──────────────────────────────────────┐             │
│  │ Password: "mypassword123"            │             │
│  │ Stored: "mypassword123"              │             │
│  │                                       │             │
│  │ Risk: Immediate access if DB leaked   │             │
│  └──────────────────────────────────────┘             │
│                                                          │
│  ❌ Basic Hashing (VULNERABLE)                          │
│  ┌──────────────────────────────────────┐             │
│  │ Password: "mypassword123"            │             │
│  │ Hash: SHA256("mypassword123")        │             │
│  │                                       │             │
│  │ Risk: Rainbow table attacks          │             │
│  └──────────────────────────────────────┘             │
│                                                          │
│  ✅ Salted Hashing (SECURE)                            │
│  ┌──────────────────────────────────────┐             │
│  │ Password: "mypassword123"            │             │
│  │ Salt: "random_salt_abc123"          │             │
│  │ Hash: bcrypt(password + salt)        │             │
│  │                                       │             │
│  │ Safe: Unique hash per password       │             │
│  └──────────────────────────────────────┘             │
│                                                          │
└─────────────────────────────────────────────────────────┘

Password Hashing Process

Figure 3: Password Hashing Flow

┌─────────────┐         ┌──────────────┐         ┌─────────────┐
│   User      │         │   Server     │         │   Database   │
│ Registration│         │              │         │              │
└──────┬──────┘         └──────┬───────┘         └──────┬──────┘
       │                       │                        │
       │ 1. Submit Password    │                        │
       ├───────────────────────>                        │
       │                       │                        │
       │                       │ 2. Generate Salt      │
       │                       │    (random)            │
       │                       │                        │
       │                       │ 3. Hash Password      │
       │                       │    bcrypt(password + salt)│
       │                       │                        │
       │                       │ 4. Store Hash + Salt  │
       │                       ├────────────────────────>
       │                       │                        │
       │ <───────────────────────                        │
       │    Success            │                        │
       │                       │                        │

Use Hashing Algorithm:

•bcrypt (recommended) - Adaptive hashing, slow by design

•Argon2 (modern, more secure) - Winner of Password Hashing Competition

•scrypt (good alternative) - Memory-hard function

Salt Passwords:

•Add random salt to each password

•Prevents rainbow table attacks

•Each password hash is unique (even same password = different hash)

Password Requirements

•Minimum length: 8-12 characters

•Require complexity: uppercase, lowercase, numbers, symbols

•Check against common passwords: Use password strength checker

•Implement rate limiting: Prevent brute force attacks on login attempts

Session Management

Session vs Token-Based Authentication

Figure 4: Session-Based Authentication Flow

┌─────────────┐         ┌──────────────┐         ┌─────────────┐
│   User      │         │   Server     │         │   Session   │
│  Browser    │         │              │         │   Store     │
└──────┬──────┘         └──────┬───────┘         └──────┬──────┘
       │                       │                        │
       │ 1. Login              │                        │
       ├───────────────────────>                        │
       │                       │                        │
       │                       │ 2. Create Session     │
       │                       ├────────────────────────>
       │                       │                        │
       │                       │ <───────────────────────
       │                       │    Session ID          │
       │                       │                        │
       │ <───────────────────────                        │
       │    Session Cookie     │                        │
       │    (sessionId)       │                        │
       │                       │                        │
       │ 3. Request with Cookie│                        │
       ├───────────────────────>                        │
       │                       │                        │
       │                       │ 4. Validate Session   │
       │                       ├────────────────────────>
       │                       │                        │
       │                       │ <───────────────────────
       │                       │    Session Data        │
       │                       │                        │
       │ <───────────────────────                        │
       │    Authorized         │                        │
       │                       │                        │

Figure 5: Token-Based Authentication Flow (JWT)

┌─────────────┐         ┌──────────────┐
│   User      │         │   Server     │
│  Browser    │         │              │
└──────┬──────┘         └──────┬───────┘
       │                       │
       │ 1. Login              │
       ├───────────────────────>
       │                       │
       │                       │ 2. Generate JWT       │
       │                       │    (signed token)     │
       │                       │                        │
       │ <───────────────────────                        │
       │    JWT Token          │                        │
       │    (contains user info)│                        │
       │                       │                        │
       │ 3. Store Token        │                        │
       │    (localStorage/cookie)│                        │
       │                       │                        │
       │ 4. Request with Token │                        │
       ├───────────────────────>                        │
       │                       │                        │
       │                       │ 5. Verify Token       │
       │                       │    (check signature)  │
       │                       │                        │
       │ <───────────────────────                        │
       │    Authorized         │                        │
       │                       │                        │

Aspect	Server-Side Sessions	Token-Based (JWT)
Storage	Server-side	Client-side
Scalability	Requires shared storage	Stateless
Revocation	Easy (delete session)	Hard (wait for expiry)
Security	More secure	Less secure (if stolen)
Use Case	Traditional apps	Microservices, APIs

res.cookie('session', sessionId, {
  httpOnly: true,
  secure: process.env.NODE_ENV === 'production',
  sameSite: 'strict',
  maxAge: 24 * 60 * 60 * 1000 // 24 hours
});

Authentication Methods Comparison

Method	Security	Complexity	Use Case
Password-Based	⭐⭐⭐ Medium	Low	Most common, simple apps
JWT Tokens	⭐⭐⭐⭐ High	Medium	APIs, microservices
OAuth 2.0	⭐⭐⭐⭐⭐ Highest	High	Third-party login
MFA	⭐⭐⭐⭐⭐ Highest	High	Sensitive accounts

Best Practices for Implementation

Security Checklist

Password Security:

•✅ Hash passwords with salt (bcrypt/Argon2)

•✅ Never store plain text passwords

•✅ Enforce password complexity requirements

•✅ Check against common passwords list

•✅ Implement password reset securely

Rate Limiting:

•✅ Limit login attempts (e.g., 5 attempts per 15 minutes)

•✅ Implement account lockout after failed attempts

•✅ Use CAPTCHA after multiple failures

Session Management:

•✅ Use httpOnly cookies for sessions

•✅ Set secure flag (HTTPS only)

•✅ Implement session expiration

•✅ Regenerate session ID after login

•✅ Implement session invalidation on logout

Token Security:

•✅ Set token expiration (24h max for JWTs)

•✅ Use refresh tokens for long-lived sessions

•✅ Store tokens securely (httpOnly cookies preferred)

•✅ Never put tokens in URLs

•✅ Implement token revocation

General Security:

•✅ Use HTTPS only

•✅ Validate all input server-side

•✅ Never trust client-side validation

•✅ Implement CSRF protection

•✅ Log authentication events

Common Mistakes to Avoid

Mistake 1: Storing plain text passwords

•❌ password: "mypassword123"

•✅ passwordHash: bcrypt.hash("mypassword123", salt)

Mistake 2: Not rate limiting login

•❌ Unlimited login attempts

•✅ Rate limit: 5 attempts per 15 minutes

Mistake 3: Weak session management

•❌ Session cookies without httpOnly flag

•✅ httpOnly: true, secure: true, sameSite: 'strict'

Mistake 4: Long-lived tokens

•❌ JWT with no expiration

•✅ JWT with 24h expiration + refresh token

Mistake 5: Trusting client validation

•❌ Only client-side password validation

•✅ Always validate server-side

Key Takeaways

1Never store passwords in plain text - always hash

2Use bcrypt or Argon2 for password hashing

3Implement rate limiting to prevent brute force

4Use httpOnly and secure cookies for sessions

5Implement token expiration and refresh mechanisms

6Consider multi-factor authentication for sensitive accounts