ajmueller / express-auth-session Goto Github PK

At last night's Front End PDX meetup where I presented this project, I was asked about how I might go about protecting from spam. I had completely forgotten that I was going to research CAPTCHAs as a possible method; there may be other ways to prevent spam. Some possibilities:

• reCAPTCHA - an implementation of Google's reCAPTCHA in Express.
• Honeypot CAPTCHA - using a single hidden input field that regular users won't fill out, but bots will.

If anyone has additional methods that they've found useful, I'd love to hear about them. This is a topic I need to research more.

Since only the first 72 characters of the password string are used, we should add a maxlength for passwords. It's definitely an edge case that anyone would ever enter a password of over 72 characters, but we should cover it nonetheless.

This might be over-doing it. Sometimes these things are best left out of frameworks and this might be one of them...

Would it be helpful to offer, out of the box, support to check the password against a sanity check of "bad" passwords like those on lists like these?

I'd love to help out. Have you thought about password expiration at all? Maybe every 12 months prompting for a new password, etc? If you don't have a timeline I could tackle that. This is something I've been looking into doing on an app I'm working on.

Thanks for this awesome project!