---
title: "Authentication, sessions and CSRF · vuejs.school"
description: "Store passwords with a slow hash, build a login that leaks nothing and limits guesses, expire and revoke sealed sessions, and refuse requests another site started."
canonical_url: "https://vuejs.school/learn/security/authentication-and-session-failures"
meta:
  "og:description": "Store passwords with a slow hash, build a login that leaks nothing and limits guesses, expire and revoke sealed sessions, and refuse requests another site started."
  "og:image": "https://vuejs.school/_og/d/a_~QXV0aGVudGljYXRpb24sIHNlc3Npb25zIGFuZCBDU1JGIMK3IHZ1ZWpzLnNjaG9vbA%2Cc_OgCard.takumi%2Ctitle_~QXV0aGVudGljYXRpb24sIHNlc3Npb25zIGFuZCBDU1JG%2Cdescription_~U3RvcmUgcGFzc3dvcmRzIHdpdGggYSBzbG93IGhhc2gsIGJ1aWxkIGEgbG9naW4gdGhhdCBsZWFrcyBub3RoaW5nIGFuZCBsaW1pdHMgZ3Vlc3NlcywgZXhwaXJlIGFuZCByZXZva2Ugc2VhbGVkIHNlc3Npb25zLCBhbmQgcmVmdXNlIHJlcXVlc3RzIGFub3RoZXIgc2l0ZSBzdGFydGVkLg%2Ceyebrow_~U2VjdXJpdHkgJiBPV0FTUCDCtyBMZXNzb24gMiBvZiA3%2Ctint_lilac%2Cp_Ii9sZWFybi9zZWN1cml0eS9hdXRoZW50aWNhdGlvbi1hbmQtc2Vzc2lvbi1mYWlsdXJlcyI%2Cs_YEH7ULsXBKUvA_Ty.png"
  "og:image:alt": "Authentication, sessions and CSRF · vuejs.school"
  "og:image:height": "600"
  "og:image:type": image/png
  "og:image:width": "1200"
  "og:title": "Authentication, sessions and CSRF · vuejs.school"
  "twitter:image": "https://vuejs.school/_og/d/a_~QXV0aGVudGljYXRpb24sIHNlc3Npb25zIGFuZCBDU1JGIMK3IHZ1ZWpzLnNjaG9vbA%2Cc_OgCard.takumi%2Ctitle_~QXV0aGVudGljYXRpb24sIHNlc3Npb25zIGFuZCBDU1JG%2Cdescription_~U3RvcmUgcGFzc3dvcmRzIHdpdGggYSBzbG93IGhhc2gsIGJ1aWxkIGEgbG9naW4gdGhhdCBsZWFrcyBub3RoaW5nIGFuZCBsaW1pdHMgZ3Vlc3NlcywgZXhwaXJlIGFuZCByZXZva2Ugc2VhbGVkIHNlc3Npb25zLCBhbmQgcmVmdXNlIHJlcXVlc3RzIGFub3RoZXIgc2l0ZSBzdGFydGVkLg%2Ceyebrow_~U2VjdXJpdHkgJiBPV0FTUCDCtyBMZXNzb24gMiBvZiA3%2Ctint_lilac%2Cp_Ii9sZWFybi9zZWN1cml0eS9hdXRoZW50aWNhdGlvbi1hbmQtc2Vzc2lvbi1mYWlsdXJlcyI%2Cs_YEH7ULsXBKUvA_Ty.png"
  "twitter:image:alt": "Authentication, sessions and CSRF · vuejs.school"
---

> Index of every page on this site: [llms.txt](https://vuejs.school/llms.txt)

# **Authentication, sessions and CSRF**

Store passwords with a slow hash, build a login that leaks nothing and limits guesses, expire and revoke sealed sessions, and refuse requests another site started.

```json
{"@context":"https://schema.org","@graph":[{"@id":"https://vuejs.school/#website","@type":"WebSite","description":"A free AI-instructed school for Vue.js. Short tutorials, runnable code and quizzes that adapt to you.","name":"vuejs.school","url":"https://vuejs.school/","publisher":{"@id":"https://vuejs.school/#identity"}},{"@id":"https://vuejs.school/learn/security/authentication-and-session-failures#webpage","@type":"WebPage","description":"Store passwords with a slow hash, build a login that leaks nothing and limits guesses, expire and revoke sealed sessions, and refuse requests another site started.","name":"Authentication, sessions and CSRF","url":"https://vuejs.school/learn/security/authentication-and-session-failures","breadcrumb":{"@id":"https://vuejs.school/learn/security/authentication-and-session-failures#breadcrumb"},"isPartOf":{"@id":"https://vuejs.school/#website"},"potentialAction":[{"@type":"ReadAction","target":["https://vuejs.school/learn/security/authentication-and-session-failures"]}],"primaryImageOfPage":{"@id":"https://vuejs.school/#logo"}},{"@id":"https://vuejs.school/#identity","@type":"Organization","description":"A free AI-instructed school for Vue.js. Short tutorials, runnable code and quizzes that adapt to you.","name":"vuejs.school","url":"https://vuejs.school","logo":{"@id":"https://vuejs.school/#logo"}},{"@id":"https://vuejs.school/learn/security/authentication-and-session-failures#article","description":"Store passwords with a slow hash, build a login that leaks nothing and limits guesses, expire and revoke sealed sessions, and refuse requests another site started.","headline":"Authentication, sessions and CSRF","inLanguage":"en","isAccessibleForFree":true,"thumbnailUrl":"https://vuejs.school/_og/d/a_~QXV0aGVudGljYXRpb24sIHNlc3Npb25zIGFuZCBDU1JGIMK3IHZ1ZWpzLnNjaG9vbA%2Cc_OgCard.takumi%2Ctitle_~QXV0aGVudGljYXRpb24sIHNlc3Npb25zIGFuZCBDU1JG%2Cdescription_~U3RvcmUgcGFzc3dvcmRzIHdpdGggYSBzbG93IGhhc2gsIGJ1aWxkIGEgbG9naW4gdGhhdCBsZWFrcyBub3RoaW5nIGFuZCBsaW1pdHMgZ3Vlc3NlcywgZXhwaXJlIGFuZCByZXZva2Ugc2VhbGVkIHNlc3Npb25zLCBhbmQgcmVmdXNlIHJlcXVlc3RzIGFub3RoZXIgc2l0ZSBzdGFydGVkLg%2Ceyebrow_~U2VjdXJpdHkgJiBPV0FTUCDCtyBMZXNzb24gMiBvZiA3%2Ctint_lilac%2Cp_Ii9sZWFybi9zZWN1cml0eS9hdXRoZW50aWNhdGlvbi1hbmQtc2Vzc2lvbi1mYWlsdXJlcyI%2Cs_YEH7ULsXBKUvA_Ty.png","@type":["Article","TechArticle"],"articleSection":["Security"],"author":{"@id":"https://vuejs.school/#identity"},"image":{"@id":"https://vuejs.school/#/schema/image/1"},"isPartOf":{"@id":"https://vuejs.school/learn/security/authentication-and-session-failures#webpage"},"keywords":["scrypt / argon2id","timing-safe login","rate limiting","session revocation","CSRF"],"mainEntityOfPage":{"@id":"https://vuejs.school/learn/security/authentication-and-session-failures#webpage"},"publisher":{"@id":"https://vuejs.school/#identity"}},{"@id":"https://vuejs.school/learn/security/authentication-and-session-failures#breadcrumb","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","name":"Skill tree","item":"https://vuejs.school/track","position":1},{"@type":"ListItem","name":"Security & OWASP","item":"https://vuejs.school/track/security","position":2},{"@type":"ListItem","name":"Authentication, sessions and CSRF","position":3}]},{"@id":"https://vuejs.school/#logo","@type":"ImageObject","caption":"vuejs.school","contentUrl":"https://vuejs.school/apple-touch-icon.png","inLanguage":"en","url":"https://vuejs.school/apple-touch-icon.png"},{"@id":"https://vuejs.school/#/schema/image/1","@type":"ImageObject","contentUrl":"https://vuejs.school/_og/d/a_~QXV0aGVudGljYXRpb24sIHNlc3Npb25zIGFuZCBDU1JGIMK3IHZ1ZWpzLnNjaG9vbA%2Cc_OgCard.takumi%2Ctitle_~QXV0aGVudGljYXRpb24sIHNlc3Npb25zIGFuZCBDU1JG%2Cdescription_~U3RvcmUgcGFzc3dvcmRzIHdpdGggYSBzbG93IGhhc2gsIGJ1aWxkIGEgbG9naW4gdGhhdCBsZWFrcyBub3RoaW5nIGFuZCBsaW1pdHMgZ3Vlc3NlcywgZXhwaXJlIGFuZCByZXZva2Ugc2VhbGVkIHNlc3Npb25zLCBhbmQgcmVmdXNlIHJlcXVlc3RzIGFub3RoZXIgc2l0ZSBzdGFydGVkLg%2Ceyebrow_~U2VjdXJpdHkgJiBPV0FTUCDCtyBMZXNzb24gMiBvZiA3%2Ctint_lilac%2Cp_Ii9sZWFybi9zZWN1cml0eS9hdXRoZW50aWNhdGlvbi1hbmQtc2Vzc2lvbi1mYWlsdXJlcyI%2Cs_YEH7ULsXBKUvA_Ty.png","inLanguage":"en","url":"https://vuejs.school/_og/d/a_~QXV0aGVudGljYXRpb24sIHNlc3Npb25zIGFuZCBDU1JGIMK3IHZ1ZWpzLnNjaG9vbA%2Cc_OgCard.takumi%2Ctitle_~QXV0aGVudGljYXRpb24sIHNlc3Npb25zIGFuZCBDU1JG%2Cdescription_~U3RvcmUgcGFzc3dvcmRzIHdpdGggYSBzbG93IGhhc2gsIGJ1aWxkIGEgbG9naW4gdGhhdCBsZWFrcyBub3RoaW5nIGFuZCBsaW1pdHMgZ3Vlc3NlcywgZXhwaXJlIGFuZCByZXZva2Ugc2VhbGVkIHNlc3Npb25zLCBhbmQgcmVmdXNlIHJlcXVlc3RzIGFub3RoZXIgc2l0ZSBzdGFydGVkLg%2Ceyebrow_~U2VjdXJpdHkgJiBPV0FTUCDCtyBMZXNzb24gMiBvZiA3%2Ctint_lilac%2Cp_Ii9sZWFybi9zZWN1cml0eS9hdXRoZW50aWNhdGlvbi1hbmQtc2Vzc2lvbi1mYWlsdXJlcyI%2Cs_YEH7ULsXBKUvA_Ty.png"}]}
```