Secure Your Node.js Web Application

If you know the enemy and know yourself, you need not fear the result of a hundred battles.

Sun Tzu

Chapter 7Bring Authentication to Your Application

You’ve securely set up your server and database, and you now have an application with valuable information people want to see. But how do you know a user is who he or she claims to be, and how do you avoid malicious impersonators? You don’t want to hand out personal information to just anyone, so you need to think about authentication.

The level of security you need when dealing with user accounts and how to validate them depends on the application and how much personal information you’re storing. Consider how much damage an attacker can do to the customer if the account is breached. If the application ...