Security
These protections ship with the template. They do not replace a review of your own extensions, but they take care of the groundwork.
Sign-in
- Passwords hashed with scrypt as OWASP recommends (N = 2¹⁷)
- Second factor with TOTP (RFC 6238), keys encrypted with AES-256-GCM
- Ten recovery codes, stored only as hashes, each valid once
- Passkeys instead of the code, bound to this site so a look-alike page cannot use them
- Account lockout after failed attempts, wrong codes count too
Tokens and links
- JWT with a fixed algorithm, issuer, audience and token type
- Refresh tokens work once; reusing one ends every session
- Password reset and email confirmation links work once and expire
- Tokens from email links never appear in a log
Browser
- Content Security Policy without inline scripts or inline styles
- CSRF token in every form, plus a Fetch Metadata check
- Session cookie with HttpOnly, Secure, SameSite=Strict and the __Host- prefix
- HSTS, COOP, COEP, CORP and Permissions-Policy
Input and operations
- Every request is checked against a schema, unknown fields are rejected
- Protection against NoSQL injection and prototype pollution
- Size limits, rate limits and timeouts against slowloris
- Error messages without internal details, with an error ID instead