4 ms·
Password storage (hashes only): PBKDF such as argon2i and salted. Limit the rate of both reset and reset re-email attempts (X within Y). Email the link that s
by heyjudy 8y ago
Password storage (hashes only): PBKDF such as argon2i and salted.
Limit the rate of both reset and reset re-email attempts (X within Y).
Email the link that should expire on first use and set an expirable token param to complete the reset.
Required login again to make sure people know their password.
Form POST.
Platform-Agnostic Security Tokens (PAST), not JSON Web Tokens (JWT) for headless API calls.
CSRF (form hidden) token.
Always https. Disable http.