0

I have this scenario in a web app which I'm working on its client-side code(I'm building it with ReactJS):

  1. I obtain user's info
  2. hash 'em
  3. send it to the server for being authenticated
  4. and when I get the result back
  5. I have to store the password and username locally in the LocalStorage for the further request to other APIs-you see it would be really inconvenient to ask for user's credentials each time while they had logged in before so I have to store 'em- (it is an obligation made by the back-end programmers to ask for the password and username for each request).

So, I'm asking if anyone knows what would be the best solution for this situation? Should I hash 'em or do something completely different? If hashing is the answer, what would be the best hashing algorithm for this matter?

| improve this question | |
  • The hash is adding no value to the process here. Why are there multiple APIs all using the same (poor) authentication mechanism and the same credentials? You should be using a credential provider / SSO mechanism and NOT storing the password anywhere – symcbean Dec 24 '18 at 18:12
  • I know the back-end design is kinda wrong or really wrong(but I want you to bear in mind that the web app is not accessible from just any IPs, they block the IPs which are not in the scope of their local area network, I, on the other hand, know the scenario for sniffing might be possible ) but as I mentioned before I'm obligated, so I was hoping maybe there is a way so I can do my fair share of coding right in this situation – BlackSheep Dec 24 '18 at 18:32
0

Firstly, My recommendation is to never stored some sensitive information at a client side.(i.e Password). Best Solution for your situation is to use the Auth0. They provide the Authentication-as-service platform. Basically they use the JWT token based mechanism. JWT token provide encryption mechanism to stored and transmit your data. In which you can set your expiration time as well. Some of the links are given below. I hope this information may help you.

https://davidwalsh.name/react-authentication

https://jwt.io/introduction/

| improve this answer | |
  • thank you a lot for answering and recommending Auth0 tool, as I see it needs a little bit of setup in the back-end but it seems really good – BlackSheep Dec 24 '18 at 18:54
  • Glad to know that my answer is help you.If it is really helpful for you than you can vote cast answer !!! cheers – Zodiac070495 Dec 25 '18 at 12:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.