Skip to main content
Information Security

You are not logged in. Your edit will be placed in a queue until it is peer reviewed.

We welcome edits that make the post easier to understand and more valuable for readers. Because community members review edits, please try to make the post substantially better than how you found it, for example, by fixing grammar or adding additional resources and hyperlinks.

2
  • I'm OP. Appreciate response! Handling the issues you mentioned - re: storing & verifying passwords and tokens - is there a single 3rd-party component that handles them all? (Say, for an Express.js webapp server). From my understanding even using, say, passport.js I would have to deal with those issues myself. Commented Apr 17, 2014 at 9:57
  • 2
    One flaw to using a "well-known component" is that, if a vulnerability is found in said component, you need to a) be aware of the vulnerability, b) wait for the component developer to patch it, and c) install the update (and also possibly d) advise your users to reset their passwords). Of course the flip side is that (a) is much easier with a published component because the vulnerabilities get published; with a roll-your-own approach, if/when someone finds a vulnerability the onus is on you to figure out that it's been compromised :P Commented Apr 17, 2014 at 13:18