Secure way of encrypting payload in Javascript for user authentification

[sam (Sam Saffron)]

@tanius

Then he discovered the hack that the same private key can be used for multiple users, so he stored it in a file on the web host that also serves the other static files of the web application (JS, CSS etc.). That makes it fast … but now that private key is (1) a shared one and (2) stored out in the open, with a publicly accessible URL. That seems, umh, frightening

Yeah don’t do this. Private key is intended to be private per client.

The 10 second key generation is a price you need to pay. There are some js crypto apis that can make it faster.