Backend Authentication — Implementing Secure Authentication in Backend APIs

const bcrypt = require('bcrypt');

// Secure password hashing
async function hashPassword(password) {
  const salt = await bcrypt.genSalt(12);  // Cost factor 12
  return bcrypt.hash(password, salt);
}

async function verifyPassword(password, hash) {
  return bcrypt.compare(password, hash);
}

// Argon2 alternative (memory-hard)
const argon2 = require('argon2');
async function argon2Hash(password) {
  return argon2.hash(password, {
    type: argon2.argon2id,
    memoryCost: 65536,  // 64 MB
    timeCost: 3,
    parallelism: 4
  });
}

// Secure JWT implementation
const jwt = require('jsonwebtoken');

function generateTokens(user) {
  const accessToken = jwt.sign(
    {
      sub: user.id,
      role: user.role,
      permissions: user.permissions
    },
    process.env.JWT_ACCESS_SECRET,
    { expiresIn: '15m', algorithm: 'RS256', issuer: 'scanapp' }
  );

  const refreshToken = crypto.randomBytes(40).toString('hex');
  const refreshHash = crypto.createHash('sha256').update(refreshToken).digest('hex');

  redis.set(`refresh:${refreshHash}`, user.id, 'EX', 7 * 24 * 60 * 60);

  return { accessToken, refreshToken };
}

// Session best practices
app.use(session({
  name: 'scan_session',  // Don't use default 'connect.sid'
  secret: process.env.SESSION_SECRET,
  resave: false,
  saveUninitialized: false,
  cookie: {
    httpOnly: true,
    secure: true,
    sameSite: 'lax',
    maxAge: 24 * 60 * 60 * 1000,
    path: '/'
  },
  rolling: true  // Reset expiry on activity
}));