Teaching plan: password storage
Learning objectives
By the end students can distinguish encoding from encryption and password hashing, choose supplied hashing/verification APIs, explain fresh salts, and verify both accepted/rejected passwords and stored-value properties.
Fits introductory secure web development, authentication foundations, or OWASP A04. This is a guided integration lesson, not cryptographic algorithm implementation. No earlier Classroom exercise is required.
Preparation
- Use Node 22+, desktop browser and a plain-text editor. No third-party packages or internet are needed after download.
- Export the student kit from the repository root as described in the exercise README. Keep the solution separate.
- Run starter and solution once on classroom hardware. Hashing uses roughly 128 MiB working memory per operation plus process overhead. Keep the default settings.
- Set the submission format and deadline. Accept copied outputs or screenshots plus the edited adapter and explanations.
- Tell students to use only the fictional passwords, never their university credentials.
- Review the walkthrough, rubric, and solution.
Suggested 75–90 minute lesson after setup
| Minutes | Activity |
|---|---|
| 0–5 | Local-server setup and safety. Explain terminal and Ctrl+C. |
| 5–20 | Create account, check correct/wrong password, inspect and decode, compare repeat registration. |
| 20–30 | Encoding, encryption, password hashing, salt and verification. |
| 30–45 | Two-line repair using the supplied API table; explain return and await. |
| 45–60 | Restart, re-register and collect the same evidence after repair. |
| 60–65 | Run seven automated checks. |
| 65–90 | Explain results, troubleshoot and submit. |
Instructional guidance
Ask “Could an application pass its login tests yet be unsafe?” before revealing the answer. Do not ask students to invent a hashing algorithm or tune scrypt settings. Exact hashed strings vary; assess behavior and interpretation.
The demo's inspector is intentionally visible. It represents what someone could learn from a leaked password database. Do not teach that exposing hashes is acceptable in real systems. It is not a password-recovery feature.
An old Base64 account is not migrated here. Restart clears the fictional account so students can re-register under the new storage method. Real migration needs a separate plan.
Optional discussion, not graded requirements
Discuss stronger passwords, rate limiting, MFA, HTTPS, sessions, and migration. OWASP prefers Argon2id; this Node 22+ no-dependency lesson uses the supported scrypt alternative. Production choice and tuning require environment-specific review.
Accessibility and fallback
All controls have visible labels and keyboard access; outputs are text, not color-only. Let students copy text instead of images. Pair work or an instructor-led demonstration is possible where Node cannot be installed. Mark an observation-only submission as such rather than calling it a completed implementation. Do not require account creation with an external service.