Node JS Authentication and Data Security
summary
Claims concrete fixes not platitudes here bcrypt is recommended over md5 because bcrypt is slow and safe and the Ashley Madison leak shows 11 million md5 hashes cracked; use PBKDF2 or scrypt for key stretching. Middleware that actually ships reduces risk so helmet and lka middleware plus csurf and passport strategies get mounted on Express and block CSRF and common header/exposure bugs. NSP scans package manifests for vulnerable modules and passwordless one‑time tokens are used in production by major firms and work in practice.
AI-written summary · about
chapters (15)
- 0:00Start
- 4:30Killing a Hydra
- 9:24Authentication
- 10:12The Oauth Top 10
- 13:12Misconfigured Applications
- 14:28Cross-Site Request Forgery
- 16:05Validating for Boards and Redirects
- 16:59Hashing
- 17:24Ashley Madison
- 18:59Efficient Hashing
- 20:36Rainbow Tables
- 22:36Correct Encoding
- 25:16Bcrypt
- 29:02Middleware
- 39:07Questions
related talks
56mNode.js Security
47mNode.js application (in)security
40m"It Me": Under the Hood of Web Authentication
27mKeeping passwords safe in 2017
41mWeb Security
58mPractical Secure Development and Operations with JavaScript in 2020
38mThe Security Toolbox For Node
56mBuilding Secure ReactJS Applications: Mastering Advanced Security Techniques