Put the defences together
A login service is where attackers aim first. Build one that never stores passwords, slows down guessing with a lockout, never reveals which emails exist, and hands back short-lived signed tokens — with your hashing and token code from Days 6 and 7.
Registration
Registration validates input, normalises the email (trim and lower-case) so [email protected] and [email protected] are the same account, rejects duplicates, and stores only the salted PBKDF2 hash. The plain password never touches storage or logs. Enforce a sensible minimum length — length matters more than forced symbols.
- Normalise email: email.trim().toLowerCase().
- Minimum password length (say 10); allow long passphrases.
- Duplicate email → a clear error (registration can reveal existence; login must not).
- Store { email, hash, failures: 0, lockedUntil: 0 }.
Check new passwords against lists of breached passwords (like Have I Been Pwned's range API) in a real service.