Security#

AuthHero is built with security as a first-class concern. This page documents every security measure, the rationale behind each decision, and how they protect against common attack vectors.

Password Hashing — Argon2#

Passwords are hashed using Argon2id, the winner of the Password Hashing Competition and the current OWASP recommendation. Argon2id combines Argon2i (side-channel resistant) and Argon2d (GPU-resistant) for the best overall security.

Token Security#

Never Store Secrets in Plaintext#

Cryptographically Random Tokens#

All tokens are generated using crypto.randomBytes() from Node.js's built-in crypto module, which uses the OS entropy pool (CSPRNG).

MFA Secret Encryption — AES-256-GCM#

TOTP secrets must be decrypted at runtime to verify codes, so they can't use one-way hashing. AuthHero encrypts them with AES-256-GCM:

CSRF Protection#

AuthHero protects against CSRF through multiple mechanisms:

• SameSite=strict cookies — Refresh token cookies are never sent in cross-origin requests
• Access token in memory — The access token is stored in JavaScript memory (Zustand), not in cookies, so it can't be leaked via CSRF
• OAuth state parameter — Random state is stored in an httpOnly cookie and compared with the callback query parameter

XSS Protection#

• httpOnly cookies — Refresh tokens are in httpOnly cookies, invisible to JavaScript (immune to XSS)
• Helmet middleware — Sets security headers including Content-Security-Policy, X-Content-Type-Options, X-Frame-Options
• No tokens in URLs — OAuth tokens are stored in Redis behind one-time codes, never exposed in redirect URLs

Rate Limiting#

All authentication endpoints are rate-limited using Redis-backed rate limiters (express-rate-limit + rate-limit-redis):

Rate limiters are per-IP in development and can be customized per-user in production. The Redis backing enables rate limiting across multiple server instances.

CORS Policy#

CORS is configured with a strict origin whitelist:

const corsOptions = {
  origin: (origin, callback) => {
    const allowedOrigins = [env.FRONTEND_URL, env.APP_URL]
      .filter(Boolean);

    if (!origin || allowedOrigins.includes(origin)) {
      callback(null, true);
    } else {
      callback(new Error("Not allowed by CORS"));
    }
  },
  credentials: true, // Allow cookies
  methods: ["GET", "POST", "PUT", "DELETE", "OPTIONS"],
};

Only FRONTEND_URL and APP_URL origins are allowed. All other origins are rejected. credentials: true is required for cookies.

Security Headers (Helmet)#

Helmet sets a comprehensive suite of security headers on every response:

Email Enumeration Prevention#

The forgot-password endpoint always returns the same response regardless of whether the email exists:

{
  "success": true,
  "message": "If an account exists, a reset link has been sent."
}

This prevents attackers from probing which emails are registered. The registration endpoint does return EMAIL_ALREADY_EXISTS since this is typically necessary for user experience (telling the user to log in instead).

Timing Attack Prevention#

When a login attempt fails, AuthHero still runs a dummy argon2 hash operation even if the user doesn't exist:

// If user not found, still hash to prevent timing-based email enumeration
if (!user) {
  await hashPassword("dummy-password");
  throw new AppError(401, "Invalid credentials", AppErrorCode.InvalidCredentials);
}

This ensures the response time is the same whether the email exists or not, preventing timing-based enumeration.

Production Security Checklist#