MFA, password hashing, and refresh token rotation

Passwords must never be stored in plaintext. Use adaptive hashing — bcrypt, scrypt, or Argon2id — with per-user salt and tuned cost factors. Verify with constant-time comparison wrappers provided by the library.

					import { hash, verify } from '@node-rs/argon2';

const passwordHash = await hash(plainPassword, {
  memoryCost: 19456,
  timeCost: 2,
});

const ok = await verify(passwordHash, candidatePassword);
				

MFA adds a second factor: TOTP apps, WebAuthn/passkeys (phishing-resistant), or hardware keys. Step-up MFA for sensitive actions even when session exists.

Refresh token rotation issues a new refresh token on each use and invalidates the previous one. Detect reuse (replay) and revoke the whole token family — signals likely theft.

On interviews: why pepper (server secret) helps if DB leaks; Argon2 parameters; recovery codes and account lockout policies without enabling denial-of-service.

Common pitfalls: MD5/SHA for passwords; emailing passwords; unlimited refresh token lifetime; MFA bypass via API routes that skip the check.

Checklist:

• Argon2id/bcrypt with monitored cost parameters.
• Phishing-resistant MFA for high-risk accounts.
• Rotate refresh tokens; detect replay.
• Rate-limit and audit failed login attempts.