Node Auth Tutorial (JWT) #7 - Hashing Passwords

Key Takeaways

so then currently when a user signs up we're taking their password and we're storing it as it is in the database in plain text format like this now this is never a good idea because if your database is compromised a hacker can see every single user password so it's very important never never do this we should always hash a password before we store it in the database so now we're going to do that so we want to hash a password just before the user document is created in the database now we've seen how we can use a hawk to fire a function just before something's saved in the database and that's this pre-hook right here so use the schema dot pre save and then we're gonna fire a function before the user document is saved and this is where we will hash the user's password because we get access to that user by using the this keyword now in order to hash the password itself we're going to install a third party package called bcrypt and bcrypt specializes in this so let us go to the second terminal over here and type in npm install be crypt like so so this is going to install bcrypt into our project for us make sure it goes into your dependencies over here once it's done and you can see this one right here so we're going to use bcrypt to do all this in a moment but before we use it i quickly want to talk about how password hashing works under the hood so when we're hashing a password there's actually two steps involved at a basic level one of those steps is to run our password through a hashing algorithm now a hashing algorithm takes in a text password and it generates a longer more seemingly random string so you can think of this as a bit like a coded password so it's already a bit more secure but this alone isn't enough because hackers can reverse engineer simple hashed passwords so another step is to generate something called a salt and attach it to the password before it's hashed now a salt is a string of characters separate from the password itself so then the end result is a hashed password and salt combination which is then stored in the database this is going to be the process we take when a new user signs up we take the password they try to sign up with we attach assault hash it and then store that in the database so when a user later tries to log in to authenticate themselves we would take the password they enter to log in with add the salt to that password hash it through the same hashing algorithm then we compare it with their hashed password stored in their database which was generated when they signed up if they match then we know that it's the correct password and we log them in if they don't then they're not logged in so this is what we're going to be doing for our website now it's not that complex to set up and in fact be crypt the package we just installed makes it really really easy to do all right so let's give this a whirl this is the package be quipped we installed just earlier so now inside the user model file i'm going to import that at the top so const bcrypt is equal to require and it's be crypt the package we want to require okay so down here we can use that inside this pre-save hook so what do we want to do well first of all we want to generate a salt so we'll say const salt is equal to be crypt dot gen salt which is a function and that generates a salt for us now this is asynchronous so we need to place a weight in front of this now in order to use a weight this function must be asynchronous and we can mark it as touch by saying async in front of it so now we have the salt inside this constant now we're going to use that with our password that the user signs up with to hash the password and then store it in the database so we're going to say this dot password now remember this refers to the instance of the user we're trying to create so already we have this local version of the user and we're going to update the password property on that so that then when it's saved to the database the password will be updated so we're going to set that equal to a weight because this is going to be asynchronous again and it's be gripped and at this time we want to use a method called hash now this method takes in two arguments the first one is the password we want to hash now that is just this dot password remember at this point we've not updated it when we pass it into the function so this is the password they try to sign up with and the second argument is going to be the salt which is this thing oh not sale salt this thing right here okay so we're doing this and we're awaiting the results and then this now is the hashed version of the password and since this all happened before we save it to the database when we go to the next function the next middleware when it saves it to the database the password is going to be the hashed one and not the plain text one so let me save that now and let me come over to postman to try this out now i need another character so let me say bowser at google.com and when i send this hopefully it will store the hashed password and it does we can see the password that we get right back here this is the hashed password and if we take a look inside the database we should see that there as well let me just refresh this page over here so that we can see it and if we scroll down we should see bowser with the long hashed password there we go so this is probably a good time to delete all of the other users because we don't want to store those anymore because they don't have hashed passwords and if you keep those in later on down the line if you try to log in with some of these users it's not going to work because we're going to be comparing hashed passwords not these original passwords okay so delete all of those until we're left with just this user with a hashed password okay so now we've got all of that out the way we're hashing passwords in the next video i want to create the sign up and the login views