3.0 KiB
3.0 KiB
id | title | challengeType |
---|---|---|
58a25c98f9fc0f352b528e7f | Hashing Your Passwords | 2 |
Description
Add BCrypt as a dependency and require it in your server. You will need to handle hashing in 2 key areas: where you handle registering/saving a new account and when you check to see that a password is correct on login. Currently on our registeration route, you insert a user's password into the database like the following:
password: req.body.password
. An easy way to implement saving a hash instead is to add the following before your database logic var hash = bcrypt.hashSync(req.body.password, 12);
and replacing the req.body.password
in the database saving with just password: hash
.
Finally on our authentication strategy we check for the following in our code before completing the process: if (password !== user.password) { return done(null, false); }
. After making the previous changes, now user.password
is a hash. Before making a change to the existing code, notice how the statement is checking if the password is NOT equal then return non-authenticated. With this in mind your code could look as follows to properly check the password entered against the hash: if (!bcrypt.compareSync(password, user.password)) { return done(null, false); }
That is all it takes to implement one of the most important security features when you have to store passwords! Submit your page when you think you've got it right.
Instructions
Tests
tests:
- text: BCrypt is a dependency
testString: getUserInput => $.get(getUserInput('url')+ '/_api/package.json') .then(data => { var packJson = JSON.parse(data); assert.property(packJson.dependencies, 'bcrypt', 'Your project should list "bcrypt" as a dependency'); }, xhr => { throw new Error(xhr.statusText); })
- text: BCrypt correctly required and implemented
testString: getUserInput => $.get(getUserInput('url')+ '/_api/server.js') .then(data => { assert.match(data, /require.*("|')bcrypt("|')/gi, 'You should have required bcrypt'); assert.match(data, /bcrypt.hashSync/gi, 'You should use hash the password in the registration'); assert.match(data, /bcrypt.compareSync/gi, 'You should compare the password to the hash in your strategy'); }, xhr => { throw new Error(xhr.statusText); })
Challenge Seed
Solution
// solution required