Secure Your Node.js Web Application

Enforce Password Strength Rules on Your Users

Now that we’ve covered storage, let’s talk about the password itself. Most users aren’t security conscious, so you have to help the user when selecting a password. The table is a top-ten list of the most popular passwords from 2014^[49] It’s obvious that people don’t really think about account security.

Table 1. Top-ten Passwords of 2014

Position	Password	2014 Rank	|	Position	Password	2014 Rank
1.	123456	Unchanged	|	6.	123456789	Unchanged
2.	password	Unchanged	|	7.	1234	Up 9
3.	12345	Up 17	|	8.	baseball	New
4.	12345678	Down 1	|	9	dragon	New
5.	qwerty	Down 1	|	10.	football	New

Don’t let your users use common dictionary passwords, because your high-tech security measures are useless if the user is using ...