passport
Simple, unobtrusive authentication for Node.js.
bcryptjs
Optimized bcrypt in plain JavaScript with zero dependencies. Compatible to 'bcrypt'.
openid-client
OAuth 2 / OpenID Connect Client API for JavaScript Runtimes
express-rate-limit
Basic IP rate-limiting middleware for Express. Use to limit repeated requests to public APIs and/or endpoints such as password reset.