Building Enterprise JavaScript Applications

Protecting against reverse lookup table attacks

Fortunately, we can easily prevent reverse lookup table attacks by appending a long, high-entropy, random string to the beginning or end of the user's password before it gets hashed. This random string is called a salt and can be publicly known.

Here's how it works: on the client, instead of hashing only the password, the client would first generate a random salt (for example, using the crypto package), and hash the concatenated string made up of the password and the salt:

const salt = crypto.randomBytes(128).toString('base64');const saltedPasswordDigest = MD5(password + salt);

The client would then send the salted password's digest, alongside the salt, to the server. The server would then store ...