Node.js Security Best Practices for Authentication

• Credential stuffing and brute force — automated login attempts using leaked credential lists.
• Injection attacks — NoSQL injection into MongoDB queries used for login lookups, or SQL injection if you are using a relational database without parameterised queries.
• Insecure token handling — JWTs stored in localStorage are readable by any JavaScript on the page, making them vulnerable to XSS.
• Timing attacks — naive string comparison leaks information about password correctness through response time differences.
• Dependency vulnerabilities — a compromised or vulnerable npm package in your auth flow can be catastrophic.
• Session fixation — an attacker pre-sets a session ID before the user logs in and then hijacks the authenticated session.

const bcrypt = require('bcrypt');

const SALT_ROUNDS = 12; // Increase this as hardware gets faster

async function hashPassword(plaintext) {
  return bcrypt.hash(plaintext, SALT_ROUNDS);
}

async function verifyPassword(plaintext, hash) {
  return bcrypt.compare(plaintext, hash);
}

// Example usage in a registration handler
app.post('/register', async (req, res) => {
  const { email, password } = req.body;

  if (password.length < 12) {
    return res.status(400).json({ error: 'Password must be at least 12 characters.' });
  }

  const hash = await hashPassword(password);
  await db.users.create({ email, passwordHash: hash });

  res.status(201).json({ message: 'Account created.' });
});

const argon2 = require('argon2');

async function hashPassword(plaintext) {
  return argon2.hash(plaintext, { type: argon2.argon2id });
}

async function verifyPassword(plaintext, hash) {
  return argon2.verify(hash, plaintext);
}

const jwt = require('jsonwebtoken');
const fs = require('fs');

const privateKey = fs.readFileSync('./keys/private.pem');
const publicKey = fs.readFileSync('./keys/public.pem');

// Generate a token (auth service only)
function issueToken(userId) {
  return jwt.sign(
    { sub: userId },
    privateKey,
    {
      algorithm: 'RS256',
      expiresIn: '15m',   // Short-lived access token
      issuer: 'https://auth.example.com',
      audience: 'https://api.example.com',
    }
  );
}

// Verify a token (any service with the public key)
function verifyToken(token) {
  return jwt.verify(token, publicKey, {
    algorithms: ['RS256'],
    issuer: 'https://auth.example.com',
    audience: 'https://api.example.com',
  });
}

function issueRefreshToken(userId) {
  return jwt.sign(
    { sub: userId, type: 'refresh' },
    privateKey,
    { algorithm: 'RS256', expiresIn: '7d' }
  );
}

app.post('/token/refresh', async (req, res) => {
  const { refreshToken } = req.body;

  try {
    const payload = verifyToken(refreshToken);

    if (payload.type !== 'refresh') {
      return res.status(401).json({ error: 'Invalid token type.' });
    }

    // Check the token has not been revoked (see below)
    const isRevoked = await tokenStore.isRevoked(refreshToken);
    if (isRevoked) {
      return res.status(401).json({ error: 'Token has been revoked.' });
    }

    const newAccessToken = issueToken(payload.sub);
    res.json({ accessToken: newAccessToken });
  } catch (err) {
    res.status(401).json({ error: 'Invalid or expired token.' });
  }
});

• localStorage is accessible to any JavaScript on the page. A single XSS vulnerability lets an attacker steal every token in storage.
• httpOnly cookies are not accessible to JavaScript at all. They are sent automatically with requests, and when combined with Secure and SameSite=Strict, they resist both XSS-based theft and CSRF.

res.cookie('accessToken', token, {
  httpOnly: true,
  secure: true,           // HTTPS only
  sameSite: 'strict',
  maxAge: 15 * 60 * 1000 // 15 minutes in ms
});

1. Denylist (blocklist): Store revoked token JTIs (jti claim) in Redis until their natural expiry. Check this list on every request.
2. Short expiry + refresh rotation: Keep access tokens very short-lived and rotate refresh tokens on each use, invalidating the old one immediately.

// Add a unique jti to every token
function issueToken(userId) {
  return jwt.sign(
    { sub: userId, jti: crypto.randomUUID() },
    privateKey,
    { algorithm: 'RS256', expiresIn: '15m' }
  );
}

// On logout, blocklist the jti
app.post('/logout', authenticate, async (req, res) => {
  const { jti, exp } = req.user; // from decoded token
  const ttl = exp - Math.floor(Date.now() / 1000);
  await redis.setEx(`blocklist:${jti}`, ttl, '1');
  res.clearCookie('accessToken');
  res.json({ message: 'Logged out.' });
});

const session = require('express-session');
const RedisStore = require('connect-redis').default;
const { createClient } = require('redis');

const redisClient = createClient();
redisClient.connect();

app.use(session({
  store: new RedisStore({ client: redisClient }),
  secret: process.env.SESSION_SECRET, // Long, random, never hardcoded
  resave: false,
  saveUninitialized: false,
  cookie: {
    httpOnly: true,
    secure: true,       // HTTPS only
    sameSite: 'strict',
    maxAge: 30 * 60 * 1000 // 30 minutes
  }
}));

• Never hardcode secret. Pull it from an environment variable or secrets manager.
• Set saveUninitialized: false so that unauthenticated requests do not create sessions.
• Use a persistent store (Redis, PostgreSQL) rather than the default in-memory store, which leaks memory and loses sessions on restart.

app.post('/login', async (req, res) => {
  const { email, password } = req.body;
  const user = await db.users.findByEmail(email);

  if (!user || !(await verifyPassword(password, user.passwordHash))) {
    return res.status(401).json({ error: 'Invalid credentials.' });
  }

  // Regenerate session ID BEFORE storing user data
  req.session.regenerate((err) => {
    if (err) return next(err);
    req.session.userId = user.id;
    res.json({ message: 'Logged in.' });
  });
});

const crypto = require('crypto');

function safeCompare(a, b) {
  const bufA = Buffer.from(a);
  const bufB = Buffer.from(b);

  // Buffers must be the same length for timingSafeEqual
  if (bufA.length !== bufB.length) return false;

  return crypto.timingSafeEqual(bufA, bufB);
}

// UNSAFE — never do this
await db.users.update(req.user.id, req.body);

// SAFE — allowlist the fields you accept
const { displayName, email } = req.body;
await db.users.update(req.user.id, { displayName, email });

// UNSAFE — user can change the id parameter
app.get('/users/:id/profile', authenticate, async (req, res) => {
  const profile = await db.users.findById(req.params.id);
  res.json(profile);
});

// SAFE — always scope queries to the authenticated user
app.get('/me/profile', authenticate, async (req, res) => {
  const profile = await db.users.findById(req.user.id);
  res.json(profile);
});

# Check for known vulnerabilities
npm audit

# Auto-fix where possible
npm audit fix

# For CI: fail the build on high-severity issues
npm audit --audit-level=high

const rateLimit = require('express-rate-limit');

const loginLimiter = rateLimit({
  windowMs: 15 * 60 * 1000, // 15-minute window
  max: 10,                   // Max 10 attempts per IP per window
  message: { error: 'Too many login attempts. Please try again later.' },
  standardHeaders: true,
  legacyHeaders: false,
});

app.post('/login', loginLimiter, async (req, res) => {
  // login logic
});

const { RedisStore } = require('rate-limit-redis');

const loginLimiter = rateLimit({
  windowMs: 15 * 60 * 1000,
  max: 10,
  store: new RedisStore({
    sendCommand: (...args) => redisClient.sendCommand(args),
  }),
});

const speakeasy = require('speakeasy');
const QRCode = require('qrcode');

// 1. Generate a secret during MFA setup
app.post('/mfa/setup', authenticate, async (req, res) => {
  const secret = speakeasy.generateSecret({
    name: `MyApp (${req.user.email})`,
    length: 20,
  });

  // Store the base32 secret (encrypted at rest)
  await db.users.update(req.user.id, {
    totpSecretPending: secret.base32,
  });

  // Return the QR code for the authenticator app
  const qrDataUrl = await QRCode.toDataURL(secret.otpauth_url);
  res.json({ qrCode: qrDataUrl });
});

// 2. Verify the user scanned it correctly
app.post('/mfa/verify-setup', authenticate, async (req, res) => {
  const { code } = req.body;
  const user = await db.users.findById(req.user.id);

  const valid = speakeasy.totp.verify({
    secret: user.totpSecretPending,
    encoding: 'base32',
    token: code,
    window: 1, // Allow 1 step of clock drift
  });

  if (!valid) {
    return res.status(400).json({ error: 'Invalid code. Please try again.' });
  }

  await db.users.update(req.user.id, {
    totpSecret: user.totpSecretPending,
    totpSecretPending: null,
    mfaEnabled: true,
  });

  res.json({ message: 'MFA enabled.' });
});

// 3. Require TOTP code at login
app.post('/login/mfa', async (req, res) => {
  const { userId, code } = req.body;
  const user = await db.users.findById(userId);

  if (!user.mfaEnabled) {
    return res.status(400).json({ error: 'MFA not configured.' });
  }

  const valid = speakeasy.totp.verify({
    secret: user.totpSecret,
    encoding: 'base32',
    token: code,
    window: 1,
  });

  if (!valid) {
    return res.status(401).json({ error: 'Invalid MFA code.' });
  }

  // Issue session or token
});

• Secure session and token management
• Password hashing and breach detection
• MFA (TOTP, SMS, passkeys)
• Social login (Google, Apple, GitHub, etc.)
• Brute force protection and rate limiting
• Audit logs and security events

// Example: protecting a route with the Authgear Node.js SDK
const { authgear } = require('@authgear/node');

app.get('/api/me', authgear.middleware(), (req, res) => {
  res.json({ userId: req.user.sub });
});

• Use a slow, purpose-built hashing algorithm (bcrypt or argon2id) for passwords.
• Sign JWTs with RS256 and set short expiry times.
• Store tokens in httpOnly cookies, never in localStorage.
• Regenerate session IDs after login and use a persistent session store.
• Add rate limiting to login endpoints and protect them with MFA.
• Run npm audit in CI to catch vulnerable dependencies before they reach production.