title: Securely Storing Password Hashes in Cache
body: <p>I am making a back-end server as a personal project. Currently, when someone registers, their password is hashed with Bcrypt, and saved in the database. However, querying the database every-time I need to verify that the request came from the authenticated user seems to be too much. As a result, I began to wonder about caching these in the server's memory. I assume that it is unsafe to store an un-hashed password in this memory. What is the most secure way to implement this? I could cache the Bcrypte'd copy of the passwords, and then just verify that the user's password matches the cached Bcrypt copy, but if I can I would like to use bcrypt as little as possible too. I assume that storing a password and its Bcrypt'd version in the cache together, even if not linked to a username, is a bad idea. Is there anything else I can do while keeping security + performance in mind?</p>