Securing Passwords and Authentication Best Practices

🌍 Introduction

In the previous lessons, we implemented user authentication and authorization. However, authentication systems are common targets for attacks.
To protect user accounts, we must secure passwords and authentication mechanisms.

In this lesson, you'll learn: ✅ Best practices for password security.
✅ How to prevent brute force attacks.
✅ How to protect JWT tokens from being stolen.
✅ Other security measures like rate limiting and multi-factor authentication (MFA).

---

📌 1. Best Practices for Password Security

✅ 1️⃣ Always Hash Passwords Before Storing

Storing raw passwords in the database is extremely dangerous. If a database leak occurs, all passwords would be exposed.

🔹 Solution: Use bcrypt for hashing passwords.
🔹 Why? bcrypt applies salt (random data) to the hash, preventing rainbow table attacks.

✔ Good Example (Hashing Passwords in Node.js)

const bcrypt = require("bcryptjs");

const hashPassword = async (password) => {
  const salt = await bcrypt.genSalt(10);
  return await bcrypt.hash(password, salt);
};

❌ Bad Example (Storing Plain Text Passwords)

const user = new User({ email, password: req.body.password }); // ❌ No Hashing

---

✅ 2️⃣ Enforce Strong Password Policies

Weak passwords make brute-force attacks easier.

✔ Good Password Policy

• Minimum 8 characters
• At least one uppercase letter
• At least one number
• At least one special character

🔹 Solution: Use a validation library like Zod or Joi:

const z = require("zod");

const passwordSchema = z.string()
  .min(8, "Password must be at least 8 characters")
  .regex(/[A-Z]/, "Must include an uppercase letter")
  .regex(/[0-9]/, "Must include a number")
  .regex(/[^A-Za-z0-9]/, "Must include a special character");

---

✅ 3️⃣ Implement Rate Limiting to Prevent Brute Force Attacks

Attackers may attempt multiple login requests to guess passwords.

🔹 Solution: Use Express Rate Limit Middleware

const rateLimit = require("express-rate-limit");

const loginLimiter = rateLimit({
  windowMs: 15 * 60 * 1000, // 15 minutes
  max: 5, // Limit to 5 login attempts per IP
  message: { error: "Too many login attempts. Please try again later." }
});

app.use("/auth/login", loginLimiter);

✔ Blocks excessive login attempts and prevents brute force attacks.

---

📌 2. Protecting JWT Tokens

✅ 4️⃣ Use Secure HTTP-Only Cookies Instead of Local Storage

Many APIs store JWT tokens in localStorage, but this is unsafe due to XSS attacks.

🔹 Solution: Store JWTs in HTTP-only cookies (safer)

res.cookie("token", token, {
  httpOnly: true,
  secure: true, // Only send over HTTPS
  sameSite: "Strict"
});

✅ Why? ✔ Prevents cross-site scripting (XSS) attacks.
✔ Ensures the token is only accessible by the server.

---

✅ 5️⃣ Implement Token Expiry and Refresh Tokens

🔹 Why? If a JWT token is stolen, it should not remain valid forever.
🔹 Solution:

• Set an expiry time for access tokens (expiresIn: "1h")
• Use refresh tokens to issue new access tokens without requiring login.

Example of issuing a short-lived access token and a refresh token:

const accessToken = jwt.sign({ userId: user._id }, process.env.JWT_SECRET, { expiresIn: "15m" });
const refreshToken = jwt.sign({ userId: user._id }, process.env.JWT_SECRET, { expiresIn: "7d" });

✔ Short-lived tokens reduce risk if stolen.
✔ Refresh tokens allow re-authentication without needing passwords.

---

📌 3. Implementing Multi-Factor Authentication (MFA)

Even with strong passwords, accounts can still be compromised. MFA adds an extra layer of security.

✅ 6️⃣ Enable Two-Factor Authentication (2FA)

🔹 Users must verify their identity using:
✔ A password (something they know)
✔ A one-time code from Google Authenticator or SMS (something they have)

🔹 Solution: Use an MFA provider like Authy, Google Authenticator, or Twilio Verify.

Example: 2FA Flow

1. User enters their email & password.
2. Server sends a one-time code (OTP) to their phone.
3. User enters the OTP to complete login.

Example: Generating a 2FA Code

const speakeasy = require("speakeasy");

// Generate a secret for the user
const secret = speakeasy.generateSecret({ length: 20 });

// Generate a one-time token
const token = speakeasy.totp({ secret: secret.base32, encoding: "base32" });

console.log("2FA Code:", token);

✅ Why?
✔ Even if a password is stolen, hackers cannot log in without the OTP.

---

📌 4. Additional Security Best Practices

✔ Use HTTPS – Prevents man-in-the-middle attacks.
✔ Log failed login attempts – Detects potential threats.
✔ Monitor API activity – Identify suspicious behavior.

---

🎯 Summary

✅ Passwords must always be hashed before storing them.
✅ Implement rate limiting to prevent brute force attacks.
✅ Use HTTP-only cookies for storing JWT tokens instead of localStorage.
✅ Implement MFA (Two-Factor Authentication) for extra security.
✅ Enforce token expiration & refresh tokens to improve security.

---

✅ Next Lesson: OAuth and Third-Party Authentication (Google, GitHub, etc.)

In the next lesson, we’ll implement OAuth authentication using Google and GitHub logins! 🚀