J
jeremy
10 minutes
Writing the Login Route That Verifies a Password
The login route looks up the account by email, explicitly asks for the hidden password hash, and compares the typed password against it with the hashing library rather than by hand. Whether the email is unknown or the password is wrong, it answers with the same message and takes about the same time, so an attacker cannot learn which emails are registered. Only after a successful check does it hand back proof of identity — a session or a token. Return a different error for 'no such user' and you have published your user list to anyone with a script.