Hashing Password With Bcrypt In Node

December 10, 2019

Introduction

In this article we will be using the bcryptjs javascript library for hashing and compare password.Here we will build a simple api fore register and login.when we will hash the password when user register and then compare that password with hash when they login.

What is bcrypt ?

bcrypt is a password hashing function designed by Niels Provos and David Mazières, based on the Blowfish cipher, and presented at USENIX in 1999.Besides incorporating a salt to protect against rainbow table attacks, bcrypt is an adaptive function: over time, the iteration count can be increased to make it slower, so it remains resistant to brute-force search attacks even with increasing computation power.

What is hashing ?

Hashing is a one way function (well, a mapping). It's irreversible, you apply the secure hash algorithm and you cannot get the original string back. The most you can do is to generate what's called "a collision", that is, finding a different string that provides the same hash. Cryptographically secure hash algorithms are designed to prevent the occurrence of collisions. You can attack a secure hash by the use of a rainbow table, which you can counteract by applying a salt to the hash before storing it.

Setup Project Folder

Open the console type below command to make a new directory
# mkdir bcrypt

Change to the new directory
# cd bcrypt

Setup Node In Project

Now setup our workspace by using the below command.
# npm init

This will generate the package.json file.Which state the node is correctly setup.
This will hold all the metadata related to our project.

Install Packages

Now install packages which will be required in our project.
Type npm install followed by package name

# npm install --save bcryptjs express body-parser mongoose

After installing packages package.json will look like this

About packages

Express - it is a framework on which our application will be built.
Body-parser - extract the entire body portion of an incoming request stream and exposes it on req.body.
Mongoose - Mongoose is an Object Data Modeling (ODM) library for MongoDB and Node.js.It manages relationships between data, provides schema validation, and is used to translate between objects in code and the representation of those objects in MongoDB.
Bcryptjs - this is a javascript library by which we can hash and compare password.

Create Model

Create a new folder models and add file user.js

The user.js will contain the collection schema of our user.

	var mongoose = require('mongoose');

	var userSchema = new mongoose.Schema({
	email:{
	type:String,
	unique:true
	},
	name:{
	type:String
	},
	password:{
	type:String
	}
	});

	module.exports = mongoose.model('user',userSchema);

view raw user.js hosted with ❤ by GitHub

mongoose.schema() - Everything in Mongoose starts with a Schema. Each schema maps to a MongoDB collection and defines the shape of the documents within that collection.
mongoose.model() - Mongoose model provides an interface to the database for creating, querying, updating, deleting records, etc.

Now we setup our application start point

Create a new file name it app.js

App.js

	var express = require('express');
	var bodyParser = require('body-parser');
	var mongoose = require('mongoose');
	var userModel = require('./models/user');
	var bcrypt = require('bcryptjs');

	//set the connection to db
	mongoose.connect('mongodb://localhost:27017/Demoo',{useNewUrlParser:true})
	.then(function(){
	console.log('connected to db');
	}).catch(function(error){
	console.log('error'+error);
	});

	var app = express();

	//fetch data from request
	app.use(bodyParser.json());

	//register user
	app.post('/register',function(req,res){
	bcrypt.genSalt(10, function(err, salt) {
	bcrypt.hash(req.body.password, salt, function(err, hash) {
	var userr = new userModel({
	email:req.body.email,
	password:hash
	});
	userr.save(function(err,data){
	if(err){
	res.json({er:error});
	}else{
	res.json({da:data,msg:'user is registerd'});
	}
	});
	});
	});
	});

	//user login
	app.post('/login',function(req,res){
	userModel.find({email:req.body.email},function(err,data){
	if(err){
	res.json({er:err});
	}else{
	if(data!=''){
	bcrypt.compare(req.body.password,data[0].password, function(err, result) {
	if(result){
	res.json({msg:'password matched'});
	}else{
	res.json({msg:'password didnt matched'});
	}
	});
	}
	else{
	res.json({msg:'user is not registerd'});
	}
	}
	});
	});

	var port = process.env.PORT \|\| 3000;
	app.listen(port,function(){
	console.log('server running at '+port);
	});

view raw app.js hosted with ❤ by GitHub

genSalt() - This will generate salt .Here we provide number of rounds to use, defaults to 10 if omitted.
hash() - this will hash our password with the salt.
compare() - compares the given data against the given hash.

Download Code From here

Click to watch the tutorial

References :-

https://en.wikipedia.org/wiki/Bcrypt
https://github.com/dcodeIO/bcrypt.js/blob/master/README.md
https://mongoosejs.com/docs/index.html
https://stackoverflow.com/questions/326699/difference-between-hashing-a-password-and-encrypting-it/326706#326706

Node.js codes

node.js