For my website that is currently in development, I am trying to figure out a way to handle authentication. I am using mysql as my database and nodejs for my server. Currently, my website does the following: Whenever a user signs up, the username, password and email are sent to the server and the password is hashed with the argon2 algorithm. Then, I use a SQL query to add the username, email and hashed password to my database. Next, for authentication when a user signs in, I verify if their password matches to the one in my database for their username, and if it does match I give them a special session token. I would have used something more popular like JWT's, but I am using a relatively new framework for my website (Svelte Kit) and I did not find any good tutorials for implementing them. Instead, for session authentication I am using a JavaScript object and encrypting it using createCipheriv
and the aes-256-ctr
algorithm (after making the object a string with JSON.stringify
). I am storing this encrypted object with localStorage
in the browser, and checking if the credentials are valid every time localStorage is changed.
To summarize, I just want to know if this way of storing information is secure and reliable for when I make my website public. I am new to information security, so any suggestions to making my approach more simple or secure would be greatly appreciated.