Credentials
scrypt password hashing (N=32768, r=8, p=1), a common-password blocklist, per-account lockout and constant-time verification with a dummy hash for unknown users.
Authentication, done the boring way.
nodeauth is a small Express application that implements the authentication features almost every product needs — passwords, sessions, two-factor, password reset, roles, an audit trail — and implements them the way the OWASP guidance says to.
Sessions
Server-side sessions in SQLite. HttpOnly, SameSite=Strict, __Host- prefixed
and Secure in production. Rotated at every privilege change, revocable individually.
Two-factor
RFC 6238 TOTP with QR enrolment, single-use recovery codes and replay protection on the current time step.
Request hardening
Synchronizer-token CSRF, a nonce-based Content-Security-Policy, HSTS, rate limiting and schema validation on every request body.