3 ms·
Could you tell me more about Passport not being secure? I've been meaning to use it in an upcoming Node project, so I'd really love to know why I shouldn't use
by mercer 10y ago
Could you tell me more about Passport not being secure? I've been meaning to use it in an upcoming Node project, so I'd really love to know why I shouldn't use it, and what I should be using instead!
- imagist 10y agoJavaScript is missing some fundamental cryptographic primitives that make it impossible to write secure software with JS, most notably it lacks any cryptographically secure random number generator. Additionally, package installs are insecure, so unless you have time to audit the entire `node_modules/` you can't actually guarantee that the code you want to run is the code you have installed. Additionally, because JS doesn't have any namespace restrictions, a vulnerability in any package allows access to the whole codebase. For a survey of problems with JS (none of which have been fixed since this was written), take a look here: https://www.grc.com/sn/files/jgc-javascript-security.pdf https://www.grc.com/sn/files/jgc-javascript-security.pdf
- mercer 10y agoThanks for the info! Do popular Ruby and Python solutions suffer from the same problem?