justinrassier / meanbrew Goto Github PK

View Code? Open in Web Editor NEW

1.0 1.0 0.0 3.45 MB

Web based homebrew based off of the MEAN stack.

JavaScript 65.02% HTML 33.84% CSS 1.14%

meanbrew's People

Contributors

Stargazers

Watchers

meanbrew's Issues

Use better password for Express session secret

In the express config, when setting up sessions, it requires a password. When getting things up and going, we just used a weak string. We should secure this better so that sessions are secure.

Don't send up full User model from DB

Right now the full user is sent up to the client side from Mongo DB. This contains the hashed password as well, which is wasteful and just stupid to do.

Create a view-model or some other projection to send only required data up to the client.

Change password hashing algorithm

Right now passwords are hashed with SHA-1. According to wikipedia (http://en.wikipedia.org/wiki/SHA-1) SHA-1 really isn't fit for modern day use and contains a theoretical attack. Since the crypto library for node handles other algorithms, we should just start off using one of them instead.

I propose SHA-256 or SHA-512 as both have had no known collisions and no known attacks.

Recommend Projects