search

clintonwoo / hackernews-react-graphql

Hacker News clone rewritten with universal JavaScript, using React and GraphQL.
MIT License
4.43k stars 554 forks source link

Password storage #7

Closed confusingstraw closed 7 years ago

confusingstraw commented 7 years ago

I'm not a security expert, but wouldn't it be advisable to only store the hashed password of a user? My understanding is that the LocalStrategy does not do any hashing for you, so the Cache is holding a plaintext copy of each user's password in memory.

clintonwoo commented 7 years ago

Password is now hashed using inbuilt Node.js crypto library and pbkdf2