All 15 Authentication & Authorization questions
More in Authentication & Authorization
What is the difference between authentication and authorization in a Node.js application? What is the difference between storing an authentication token in localStorage versus an httpOnly cookie, from a security perspective? How does session-based authentication work in a Node.js/Express application, and what does the session store need to handle? What is a JSON Web Token (JWT), and what are its three parts? What is Passport.js, and how do its 'strategies' provide a consistent authentication abstraction across different methods? What is Role-Based Access Control (RBAC), and how would you implement it as Express middleware? What is CSRF (Cross-Site Request Forgery), and how do you protect a Node.js session-based application against it? How do you implement email verification and password-reset flows securely in a Node.js application? How would you implement Attribute-Based Access Control (ABAC) in a Node.js application when RBAC roles aren't expressive enough? How do you implement JWT refresh token rotation in a Node.js API, and why is it more secure than a single long-lived token?
Advertisement
Node.js › Authentication & Authorization

How should passwords be securely stored in a Node.js application's database, and why is bcrypt commonly used?

Beginner

Answer

Passwords should never be stored in plain text or with a fast, general-purpose hash like SHA-256 alone -- they should be hashed with a purpose-built, deliberately slow password-hashing algorithm like bcrypt (or argon2/scrypt), which incorporates a random per-password salt automatically and can be tuned to be computationally expensive enough to make brute-force and rainbow-table attacks impractical, even if the password database is ever leaked.
const bcrypt = require('bcrypt');

// Hashing during registration
const hashedPassword = await bcrypt.hash(plainTextPassword, 12); // 12 = cost factor
await User.create({ username, password: hashedPassword });

// Verifying during login
const isMatch = await bcrypt.compare(submittedPassword, user.password);
Real-world example A company's user database is leaked in a breach, but because passwords were hashed with bcrypt at a cost factor of 12 rather than stored as plain SHA-256 hashes, attackers are unable to feasibly crack the vast majority of passwords even with significant computing resources, buying users critical time to change their passwords.

Common follow-ups: What is a 'cost factor' in bcrypt, and how do you choose an appropriate value that balances security and login-request latency?;Why is a per-password random salt important even when using a strong hashing algorithm?

Security;Databases & ORMs (MongoDB/Mongoose SQL/Sequelize)
All 15 Authentication & Authorization questions