Node.js Security

  1. Authentication and Authorization
    1. Password Security
      1. Password Storage
        1. Hashing vs Encryption
          1. Salt Generation
            1. Pepper Implementation
            2. Hashing Algorithms
              1. bcrypt Configuration
                1. Argon2 Implementation
                  1. PBKDF2 Usage
                    1. Scrypt Considerations
                    2. Password Policies
                      1. Complexity Requirements
                        1. Length Recommendations
                          1. Common Password Prevention
                        2. Session Management
                          1. Session Storage
                            1. In-Memory Sessions
                              1. Database Sessions
                                1. Redis Session Store
                                  1. Distributed Sessions
                                  2. Session Lifecycle
                                    1. Session Creation
                                      1. Session Validation
                                        1. Session Expiration
                                          1. Session Invalidation
                                        2. Token-Based Authentication
                                          1. JSON Web Tokens
                                            1. JWT Structure
                                              1. Header Configuration
                                                1. Payload Design
                                                  1. Signature Verification
                                                  2. Signing Algorithms
                                                    1. HMAC-based Algorithms
                                                      1. RSA-based Algorithms
                                                        1. ECDSA Algorithms
                                                        2. Token Management
                                                          1. Token Storage
                                                            1. Token Refresh
                                                              1. Token Revocation
                                                                1. Token Validation
                                                              2. Multi-Factor Authentication
                                                                1. TOTP Implementation
                                                                  1. Secret Generation
                                                                    1. QR Code Generation
                                                                      1. Time Window Configuration
                                                                      2. SMS Authentication
                                                                        1. SMS Gateway Integration
                                                                          1. Rate Limiting
                                                                            1. Backup Codes
                                                                            2. Hardware Tokens
                                                                              1. FIDO2/WebAuthn
                                                                                1. U2F Implementation
                                                                              2. Access Control
                                                                                1. Role-Based Access Control
                                                                                  1. Role Definition
                                                                                    1. Permission Assignment
                                                                                      1. Hierarchical Roles
                                                                                      2. Attribute-Based Access Control
                                                                                        1. Policy Definition
                                                                                          1. Context Evaluation
                                                                                            1. Dynamic Permissions
                                                                                            2. Middleware Implementation
                                                                                              1. Route Protection
                                                                                                1. Resource-Level Authorization
                                                                                                  1. Method-Level Security
                                                                                                2. OAuth and OpenID Connect
                                                                                                  1. OAuth 2.0 Flows
                                                                                                    1. Authorization Code Flow
                                                                                                      1. Implicit Flow
                                                                                                        1. Client Credentials Flow
                                                                                                          1. Resource Owner Password Flow
                                                                                                          2. OpenID Connect
                                                                                                            1. Identity Token Validation
                                                                                                              1. UserInfo Endpoint
                                                                                                                1. Discovery Document
                                                                                                                2. Security Considerations
                                                                                                                  1. PKCE Implementation
                                                                                                                    1. State Parameter Usage
                                                                                                                      1. Nonce Validation

                                                                                                                  Previous

                                                                                                                  5. Secure Coding and Configuration

                                                                                                                  Go to top

                                                                                                                  Next

                                                                                                                  7. Data Security