bcrypt is from 1999. Your passwords deserve better
bcrypt was designed in 1999 for a world without GPU mining. argon2id won the 2015 Password Hashing Competition by making GPU attacks economically impractical through memory-hardness. Dulak uses it.
auth
2 posts with the tag “auth”
JWT is the wrong default. Sessions are the right one
JWT is sold as stateless auth. In practice you need a revocation list — which is server state. Dulak uses DB-backed sessions: one row in SQLite, delete to revoke.