{"componentChunkName":"component---src-pages-markdown-remark-fields-slug-js","path":"/engineering/password-hashing-with-nodejs/","result":{"data":{"markdownRemark":{"id":"a36f7982-5ef2-5520-928f-cbb37723e31a","excerpt":"In this blog, we’ll be implementing authentication with password hashing in a Node.js web application. For this, we’ll be using crypto, a package password…","html":"

In this blog, we’ll be implementing authentication with password hashing in a Node.js web application. For this, we’ll be using crypto, a package password hashing for Node.js.

\n

The Crypto module for Node JS helps developers to hash user passwords.

\n

Pre-requisites:

\n\n

Step 1. First, create a directory structure as below :

\n

hashApp

\n
--model\n----user.js\n--route\n----user.js\n--server.js
\n

Step 2. Create model/user.js file and add the following code :

\n
// Importing modules \nconst mongoose = require('mongoose'); \nvar crypto = require('crypto'); \n  \n// Creating user schema \nconst UserSchema = mongoose.Schema({ \n    name : { \n        type : String, \n        required : true\n    }, \n    email : { \n        type : String, \n        required : true\n    }, \n    hash : String, \n    salt : String \n}); \n  \n// Method to set salt and hash the password for a user \nUserSchema.methods.setPassword = function(password) { \n     \n // Creating a unique salt for a particular user \n    this.salt = crypto.randomBytes(16).toString('hex'); \n  \n    // Hashing user's salt and password with 1000 iterations, \n     \n    this.hash = crypto.pbkdf2Sync(password, this.salt,  \n    1000, 64, `sha512`).toString(`hex`); \n}; \n  \n// Method to check the entered password is correct or not \nUserSchema.methods.validPassword = function(password) { \n    var hash = crypto.pbkdf2Sync(password,  \n    this.salt, 1000, 64, `sha512`).toString(`hex`); \n    return this.hash === hash; \n}; \n  \n// Exporting module to allow it to be imported in other files \nconst User = module.exports = mongoose.model('User', UserSchema);
\n

Step 3. Create route/user.js file and add the following code:

\n
// Importing modules \nconst express = require('express'); \nconst router = express.Router(); \n\n// Importing User Schema \nconst User = require('../model/user'); \n\n// User login api \nrouter.post('/login', (req, res) => { \n\n    // Find user with requested email \n    User.findOne({ email : req.body.email }, function(err, user) { \n        if (user === null) { \n            return res.status(400).send({ \n                message : "User not found."\n            }); \n        } \n        else { \n            if (user.validPassword(req.body.password)) { \n                return res.status(201).send({ \n                    message : "User Logged In", \n                }) \n            } \n            else { \n                return res.status(400).send({ \n                    message : "Wrong Password"\n                }); \n            } \n        } \n    }); \n}); \n\n// User signup api \nrouter.post('/signup', (req, res, next) => { \n\n\n// Creating empty user object \n    let newUser = new User(); \n\n    // Initialize newUser object with request data \n    newUser.name = req.body.name, \n\n    newUser.email = req.body.email,\n\n\n    newUser.password=req.body.password\n\n                    // Call setPassword function to hash password \n                    newUser.setPassword(req.body.password); \n\n    // Save newUser object to database \n    newUser.save((err, User) => { \n        if (err) { \n            return res.status(400).send({ \n                message : "Failed to add user."\n            }); \n        } \n        else { \n            return res.status(201).send({ \n                message : "User added successfully."\n            }); \n        } \n    }); \n}); \n// Export module to allow it to be imported in other files \nmodule.exports = router;
\n

Step 4. Create server.js file :

\n
// Importing modules\nvar express = require('express');\nvar mongoose = require('mongoose');\nvar bodyparser = require('body-parser');\n  \n// Initialize express app\nvar app = express();\n  \n// Mongodb connection url\nvar MONGODB_URI = "mongodb://localhost:27017/hashAppDb";\n  \n// Connect to MongoDB\nmongoose.connect(MONGODB_URI);\nmongoose.connection.on('connected', () => {\n    console.log('Connected to MongoDB @ 27017');\n});\n  \n// Using bodyparser to parse json data\napp.use(bodyparser.json());\n  \n// Importing routes\nconst user = require('./route/user');\n  \n// Use user route when url matches /api/user/\napp.use('/api/user', user);\n  \n// Creating server\nconst port = 3000;\napp.listen(port, () => {\n    console.log("Server ru\nnning at port: " + port);\n});
\n

Step 5. Run server.js file using command

\n
node server.js
\n

Step 6. Open Postman and create a post request to localhost:3000/api/user/signup with following body parameter:

\n
{\n"name" : "test".\n"email" : "test@test.com",\n"password" : "test1234"\n}
\n

Run the request and you will get a success response:

\n
{\n"message" : "user added sucessfully"\n}
\n

User data is stored in the database as below:

\n
    "_id": {\n        "$oid": "5ab71ef2afb6db0148052f6f"\n    },\n    "name": "test",\n    "email": "test@test.com",\n    "salt": "ddee18ef6a6804fbb919b25f790005e3",\n    "hash": "bbf13ae4db87d475ca0ee5f97e397248a23509fc10c82f1e3cf110\n     b352c3ca6cc057955ace9d541573929cd7a74a280a02e8cb549136b43df7704caaa555b38a",\n    "__v": 0\n}
\n

If we have sensitive data or information that you need to be protected, ensuring it is secured correctly is important. With the above process, we can now successfully store our hashed password into our database with a bit of additional security.

\n

You can check the code on Github.

\n","headings":[],"fields":{"slug":"/engineering/password-hashing-with-nodejs/"},"frontmatter":{"metatitle":null,"metadescription":null,"description":null,"title":"Password hashing with NodeJS","canonical":null,"date":"June 25, 2020","updated_date":null,"tags":["Security","NodeJs"],"coverImage":{"childImageSharp":{"fluid":{"aspectRatio":1.4598540145985401,"src":"/static/7c5686f355f37377e26ec91cbaa6cbed/2ad7f/cover.webp","srcSet":"/static/7c5686f355f37377e26ec91cbaa6cbed/1c9b5/cover.webp 200w,\n/static/7c5686f355f37377e26ec91cbaa6cbed/f1752/cover.webp 400w,\n/static/7c5686f355f37377e26ec91cbaa6cbed/2ad7f/cover.webp 800w,\n/static/7c5686f355f37377e26ec91cbaa6cbed/e7405/cover.webp 1200w,\n/static/7c5686f355f37377e26ec91cbaa6cbed/952a8/cover.webp 1440w","sizes":"(max-width: 800px) 100vw, 800px"}}},"author":{"id":"Ashish Sharma","github":"ashish8947","bio":"Ashish is a software engineer who continually seeks clean, elegant solutions to business challenges. His lifelong passion for technology drives him to proactively expand horizons, constantly exploring and evaluating new languages, platforms, frameworks and tools.","avatar":null}}}},"pageContext":{"id":"a36f7982-5ef2-5520-928f-cbb37723e31a","fields__slug":"/engineering/password-hashing-with-nodejs/","__params":{"fields__slug":"engineering"}}},"staticQueryHashes":["1171199041","1384082988","1711371485","1753898100","2100481360","229320306","23180105","528864852"]}