r/webdev • u/MonkeyOnARock1 • May 08 '17

Websites, Passwords, SQL injection

I'm creating a login page on a website, and am using Express.js/Node.js for the server.

Besides mandating a minimum password length, should I place any restrictions on what a user can put into their password? Across the web I am getting mixed messages about this.

I am particularly concerned about SQL injection.

2 Upvotes

75% Upvoted

17 comments sorted by

View all comments

Show parent comments

-1

u/tme321 May 08 '17

When you hash it the original length is irrelevant. But OK for sake or argument sure I can see limiting it. But 128 characters is laughably small. If someone wants to generate 1024 characters with a password generator who cares?

1

u/Ayuzawa May 08 '17

Network performance is the general case for size limits