Cybersecurity Foundations·A security baseline you can use

Authentication that resists guessing

Passwords are a liability; hash them slowly and treat sessions as credentials.

Beginner 15 min read Lesson 7 of 300 Challenge included

What you will be able to do

Hash passwords with a memory-hard algorithm and unique salts.
Use httpOnly, secure, sameSite cookies for browser sessions.
Require MFA for privileged actions where possible.

In plain English

Use a slow, salted password hash such as argon2id or bcrypt. Never store reversible passwords. Rate-limit login attempts, return generic errors and rotate the session on privilege changes.

auth.jsJavaScript

import argon2 from 'argon2'

const hash = await argon2.hash(password, {
  type: argon2.argon2id,
  memoryCost: 19456,
  timeCost: 2,
})

const valid = await argon2.verify(hash, candidate)
if (!valid) return response.status(401).json({ error: 'INVALID_CREDENTIALS' })

response.cookie('session', token, {
  httpOnly: true,
  secure: true,
  sameSite: 'lax',
  path: '/',
})

Your turn

Harden a login response

Medium

Return a generic 401 for an invalid account or password and set a secure session cookie only on success.

JS · starter

if (!user) return response.status(401).json({ error: 'NO_USER' })

Check your understanding before moving on.

Knowledge checkQuestion 1

Which storage method is appropriate for passwords?

Select an answer to continue

Study tools

Make it yours.

Keep a private note for this lesson, then turn the key ideas into flashcards you can revisit.

Sign in to save notes and flashcards.Both are private to your account and stay with your progress.

Finished reading?

Lock in what you just learned.

Mark this lesson complete to save your place and move one step closer to the certificate.

Next: XSS, SQL injection and CSRF

Lesson 7 of 300 · 0% of course