Advanced level · Module 2: Authentication and Web Security · Lesson 1 of 4
Passwords and Login
Store passwords with a slow hashing algorithm and build a login flow that does not leak information.
In this lesson you will
- Hash and verify passwords with bcrypt or argon2
- Build a login endpoint with safe error messages and rate limiting
Key concepts
password hashingsaltcredential stuffingrate limiting
The lesson
Never store passwords as plain text or with fast hashes such as MD5. Use a slow, salted algorithm designed for passwords, such as bcrypt or argon2, so stolen hashes are expensive to crack.
On login, look up the user and verify the password with the library's compare function. Return the same message for 'unknown email' and 'wrong password' so attackers cannot discover which emails are registered.
Limit login attempts per account and IP address to slow down attackers trying leaked passwords from other sites (credential stuffing). Offer a secure password-reset flow with single-use, expiring tokens.
Step by step
- Add a users table with a password_hash column.
- Hash passwords on registration.
- Verify them on login with a generic error message.
- Add rate limiting to the login route.
Practice activity
Implement staff registration (by an admin) and login for the booking platform.
Expected result: Passwords are stored only as hashes, failed logins give a generic message and repeated failures are throttled.
Check your understanding
-
Why use a slow hashing algorithm for passwords?
Show answer
It makes cracking stolen hashes far more expensive.
-
Why give the same message for unknown email and wrong password?
Show answer
So attackers cannot learn which emails have accounts.
Taught live by an instructor — online or in person. Free course lessons are for self-study and do not lead to a certificate — see registration options.