1

i have some experience (mostly as a student) with react and redux, and on the other hand i also have some experience with express, normally for my apps (all of them are really simple) i make a rest api with express, make express interact with mongo or any db im using and then retrieve the data to react. That's kinda all the experience i have with them.

Now, i want to make an app with an accounts system: register + login + authorization stuff (accounts levels and stuff like that) but i'm kinda lost on where to begin

the only thing i ever did related to this was sending the user and password to the express server, verificate and then send some data back and store it in a cookie, and that way check if a user is authorized to do something or not

i know that this is the most unsafe way of doing it, so that's why i ask what the correct way should be, what technologies should i be using? how should i architect my apps?

1

Independently of your experience as a software developer,¹ if you'll try design an authentication system yourself, you'll do it wrong. You can, of course, learn about hashes and salts, and use PBKDF2 instead of SHA256, and implement anti-brute force techniques, and you'll still miss one little thing which will let an attacker to gain access to every account in your system.

Therefore, whenever you can, delegate this task to other companies. In most projects, you can do it with ease by implementing OpenID and OAuth2. For instance, you can let Google deal with authentication, which would mean that you'll only store the IDs of users provided by Google, and never ever store any password.

Of course, Google is not the only provider. There is Facebook, Twitter, and dozens or hundreds of others. In corporate environment, you'll often have a dedicated OpenID service used for Single Sign-On.

The fact that you don't deal with passwords (and not even receiving them on your servers) has four very important benefits:

  • You don't handle the risk of a hacker stealing your users' passwords from you.
  • There is less chance your system will be hacked in the first place: if you don't store something a hacker would like to have, what's the goal of hacking you?
  • You don't waste all the time setting up authentication.
  • There are no legal aspects related to the storage of sensitive data.

Note that implementing OpenID/OAuth2 in a website is often easy. Most languages/frameworks have libraries which provide a straightforward way to include a link to OpenID/OAuth2.


¹ If you have ten years experience as a security expert, then you're probably fine designing a login system.

  • Note that having ten years of experience as a security expert may be sufficient for designing a login system, but you'll also need another security expert (also with ten years of experience) to review the design and implementation. Also, you'll need to upgrade your login system as security standards change (at a minimum, changing hashing protocols). As an aside, be aware that there are legal aspects relating to the storage of sensitive data, even for the storing of OpenID identifies. Such identifiers are considered personally identifying information and must be protected as such. – Brian May 16 '18 at 13:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.