I am coding up the security for a website in express.js and postgresql database. Now I have been reading about salting and hashing and I have the code set up with pbkdf2 using the crypto module, but my issue is how I will structure the account table in the database.

Should I create a login role which will have an MD5 encrypted format for the password, which will be the derived key from the salt and hash "procedure"? Would that be overkill?

There will be a table which will be as follows: UID (the ID from the login role), SALT , HASH and also the login role.

So on a try for authentication, the code will try to login as that role, first by getting the assosiated UID, generating the salt and hashed password for the password provided and auth on a DB level.

Hope I am making some sense.

   var usrSalt = crypto.randomBytes('128').toString('base64');
   //text , salt ,iterations , keylen , callback
   crypto.pbkdf2(usr, usrSalt, 10000, 512, function (err, derivedKey) {
       if (err) { console.log(err); }
       else {
           usr = derivedKey;

P.S. Would a pgcrypto module be better again in the same scenario, just by removing the code on node.js.

  • 1
    There is not enough context but most often it is an overkill to create in the database one role/login per user accessing the application. It may make sense for a lower number of users and/or a need of highly separated data in the DB, but otherwise let the application handle its users and use the DB just to store the login details. Your table structure seem ok. Make sure to store the HASH with an identifier in the beginning to know which algo was used. Commented Nov 26, 2017 at 23:57

1 Answer 1


The most common pattern for web applications is for the application to authenticate using a role account, and then to perform user authentication against the database. I would not grant individual user accounts access to the database -- consider the case where your database is inadvertently exposed to the internet. Do you want user credentials to be usable in that case? (It is slightly better in the case you've described, where they're derived from some PBKDF2 function.)

Your web application will require a role account in any case: it will need to register new users, retrieve the per-user salt for the PBKDF2 operation, and (depending on the application) need to perform operations for anonymous users.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .