How to Implement Secure Authentication in Node.js with JWT, OAuth 2.0 and bcrypt

·1 views

A detailed technical guide outlines a production-grade authentication system for Node.js backends, covering password hashing, JSON Web Tokens, refresh tokens, and OAuth 2.0 integration. The approach uses bcrypt with a cost factor of 12 to slow down potential dictionary attacks while remaining imperceptible to legitimate users. The security model separates short-lived access tokens (15 minutes) from longer-lived refresh tokens (7 days), storing each in different locations to limit exposure. Additional hardening measures include httpOnly cookies, CSRF protection, and rate limiting on all authentication routes. The guide aims to address common vulnerabilities — such as token theft via XSS and non-expiring refresh tokens — that standard tutorials typically overlook.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Queue Depth-Based Router Proposed to Stop Secret Prompts Leaking to Cloud

A workflow proposal suggests that AI coding agents on shared workstations need a router that classifies prompts before deciding where to send them. The problem arises when local GPU queues become congested, prompting developers to redirect all requests — including those containing sensitive data like API keys — to remote hosted endpoints. The proposed router uses four signals — secret classification, local queue depth, offline status, and a wait-time budget — to determine whether a prompt should be processed locally or remotely. Only prompts classified as non-secret are permitted to leave the machine, and only when local waiting would exceed a defined time threshold. The design prioritises explainability and auditability, with each routing decision stored as serialisable JSON so incident reviews can trace exactly why a prompt was sent off-device.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How to Spot and Fix Fail-Open Defaults in AI-Generated Code PRs

AI agent-generated pull requests can introduce unverified default values — such as hardcoded URLs and timeout figures — that have no traceable source in the existing codebase. A key risk is 'fail-open' behavior, where error-handling code silently returns a success response even when a critical service like billing is unreachable. Reviewers are advised to audit every new environment variable, endpoint, and return shape introduced by an agent patch, building a provenance table that cites a verified source for each default or strips it entirely. Automated scanning scripts and targeted regex searches can help surface swallowed errors and invented fallback values that visual review might miss. The recommended standard is fail-closed behavior by default, meaning errors should throw exceptions rather than return false success signals, unless a written SLA explicitly permits deferral.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

JSON.stringify Edge Cases That Silently Break Production JavaScript Apps

JavaScript's JSON.stringify is widely used but carries several silent failure modes that can cause hard-to-trace production bugs. Undefined values, functions, and Symbols are quietly dropped from objects or converted to null in arrays, with no error or warning thrown. Special numeric values like NaN and Infinity are all serialized as null, erasing their original meaning, while Map and Set objects serialize as empty objects by default. Dates serialize correctly only because they implement a toJSON method, a hook developers can use in their own classes. BigInt values are the exception, triggering an outright TypeError rather than a silent conversion, making them easier to catch but still a common stumbling block.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer Builds Open-Source Library for Particle-Based DOM Element Animations

A developer has released Vanilla Disintegrate, an open-source JavaScript library that animates the removal and restoration of DOM elements using particle effects, inspired by the so-called 'Thanos snap' effect seen in messaging apps. The library is framework-agnostic and works directly with standard DOM elements, requiring no special markup or mandatory CSS files. It ships with ready-to-use presets and an interactive web playground where developers can fine-tune particle movement, timing, and sound before copying the generated configuration into their code. The project grew out of a real-world 'remove from favorites' interaction problem the developer encountered at work, where common fade and scale animations felt too familiar to be memorable. Custom rendering support is also available for developers who need to go beyond the built-in particle renderer.

0 comments Read more at DEV Community