secure-auth-patterns

Secure Auth Patterns

Authentication, session management, and access control implementation patterns with language-specific secure code examples.

Knowledge Base

Password Storage

Never store passwords in plaintext, encrypted form, or with weak hashes (MD5, SHA-1, unsalted SHA-256). Use adaptive hashing algorithms designed for password storage.

Algorithm selection (OWASP 2023 recommendations):

Algorithm	Recommended Parameters	Notes
Argon2id	Memory: 19456 KB, Iterations: 2, Parallelism: 1	Preferred. Memory-hard, GPU-resistant
bcrypt	Cost factor: 12+	Widely supported, 72-byte input limit
scrypt	N: 2^17, r: 8, p: 1	Memory-hard, less common than Argon2
PBKDF2-SHA256	600,000 iterations	Only if above are unavailable (FIPS)

Implementation examples:

# Python - Argon2 (preferred)
from argon2 import PasswordHasher
ph = PasswordHasher(time_cost=2, memory_cost=19456, parallelism=1)
hash = ph.hash(password)
# Verify
try:
    ph.verify(hash, password)
    if ph.check_needs_rehash(hash):  # Upgrade params over time
        new_hash = ph.hash(password)
except VerifyMismatchError:
    # Invalid password

# Python - bcrypt
import bcrypt
hash = bcrypt.hashpw(password.encode(), bcrypt.gensalt(rounds=12))
if bcrypt.checkpw(password.encode(), hash):
    # Valid

// Node.js - bcrypt
const bcrypt = require('bcrypt');
const hash = await bcrypt.hash(password, 12);
const valid = await bcrypt.compare(password, hash);

// Node.js - Argon2
const argon2 = require('argon2');
const hash = await argon2.hash(password, {
  type: argon2.argon2id,
  memoryCost: 19456,
  timeCost: 2,
  parallelism: 1
});
const valid = await argon2.verify(hash, password);

// Go - bcrypt
import "golang.org/x/crypto/bcrypt"
hash, err := bcrypt.GenerateFromPassword([]byte(password), 12)
err = bcrypt.CompareHashAndPassword(hash, []byte(password))

// Go - Argon2
import "golang.org/x/crypto/argon2"
salt := make([]byte, 16)
rand.Read(salt)
hash := argon2.IDKey([]byte(password), salt, 2, 19456, 1, 32)