Your Node.js authentication tutorial is wrong
1–10 of 17 posts
Re: Your Node.js authentication tutorial is wrong
#2Authentication is hard. And that's exactly why you should never have to be writing your own auth code, but rather, use existing frameworks.
There's so many tiny details and edge cases that can have such catastrophic results, it's too much of a risk to do it yourself. Unless writing auth frameworks is your job, for course.
Re: Your Node.js authentication tutorial is wrong
#3Has bcrpyt become the node standard? There's no mention of pbkdf2, which I thought was NIST's current recommendation.
Re: Your Node.js authentication tutorial is wrong
#4Has bcrpyt become the node standard? There's no mention of pbkdf2, which I thought was NIST's current recommendation.
bcrypt is a hashing algorithm, pbkdf2 is a key derivation function. Am I missing something?
Re: Your Node.js authentication tutorial is wrong
#5Authentication is hard. And that's exactly why you should never have to be writing your own auth code, but rather, use existing frameworks. There's so many tiny details and edge cases that can have such catastrophic results, it's too much of a risk to do it yourself. Unless writing auth frameworks is your job, for course.
So what are the current good options in Node?
Re: Your Node.js authentication tutorial is wrong
#6Has bcrpyt become the node standard? There's no mention of pbkdf2, which I thought was NIST's current recommendation.
bcrypt is a hashing algorithm, pbkdf2 is a key derivation function. Am I missing something?
pbkdf2 can be used as a computationally expensive hash... bcrypt does a few other things in terms of the output format beyond just the hash though, it contains enough information to repeat the hashing settings to verify another entry against it.
IIRC bcrypt isn't an in-the box feature in crypto, but pbkdf2 is.
Re: Your Node.js authentication tutorial is wrong
#7Authentication is hard. And that's exactly why you should never have to be writing your own auth code, but rather, use existing frameworks. There's so many tiny details and edge cases that can have such catastrophic results, it's too much of a risk to do it yourself. Unless writing auth frameworks is your job, for course.
So what are the current good options in Node?
I have yet to see a good clean solution. I was fairly new to auth and node when I was given a similar task. Ended up doing a ton of research and I felt I was making decisions I should not have had to make. I recall the tutorials that the article mentions. I was not impressed with the end result.
Re: Your Node.js authentication tutorial is wrong
#8Authentication is hard. And that's exactly why you should never have to be writing your own auth code, but rather, use existing frameworks. There's so many tiny details and edge cases that can have such catastrophic results, it's too much of a risk to do it yourself. Unless writing auth frameworks is your job, for course.
Honestly, I don't think there is a real shortcut for in depth knowledge of how secure authentication should work. I think if your going to be writing a program with authentication, you need to know what is going on, what the framework is doing under the hood. If you don't, you are likely to misconfigure it or trust it to do something it doesn't do.
Writing a secure auth isn't exactly hard, and there is good info on the web about it. It just requires time to implement and not taking shortcuts to do it right.
In node there are not really official solutions - it's just packages. Php has a nice password_hash function which hashes and salts your password for you securely.
Re: Your Node.js authentication tutorial is wrong
#9Authentication is hard. And that's exactly why you should never have to be writing your own auth code, but rather, use existing frameworks. There's so many tiny details and edge cases that can have such catastrophic results, it's too much of a risk to do it yourself. Unless writing auth frameworks is your job, for course.
So what are the current good options in Node?
There isn't one.
I think that the Node ecosystem tends toward minimalism and compartmentalization in modules, and in doing so monolithic authentication solutions don't really exist like they do in other frameworks in which there's more "magic", like Ruby/Rails.
You'd have to choose a higher-level Node.js-based framework, and there isn't an emergent solution yet. Personally I've been directed toward Hapi and Feathers.js as of late. Feathers I committed some PRs to and filed some issues against this weekend, which the maintainers are taking seriously, but it could use some more functionality and deeper testing. Hapi I haven't personally looked at, but is backed by some of the Auth0 guys.
Re: Your Node.js authentication tutorial is wrong
#10Authentication is hard. And that's exactly why you should never have to be writing your own auth code, but rather, use existing frameworks. There's so many tiny details and edge cases that can have such catastrophic results, it's too much of a risk to do it yourself. Unless writing auth frameworks is your job, for course.
Honestly, I don't think there is a real shortcut for in depth knowledge of how secure authentication should work. I think if your going to be writing a program with authentication, you need to know what is going on, what the framework is doing under the hood. If you don't, you are likely to misconfigure it or trust it to do something it doesn't do. Writing a secure auth isn't exactly hard, and there is good info on t…
I disagree. Do you believe that web application developers should be able to write an efficient JavaScript interpreter, or build a working CPU in Verilog? As technology increases in complexity, roles specialize. Skillsets diverge and junior developers should have frameworks accessible to them they can rely on.
Most of us have made our careers standing upon the shoulders of relative giants until we have grown enough to become taller ourselves. I don't believe that you should have to be able to build a reliable authentication framework to be able to write a decently secure web application.