Welcome back. Security is a very very important thing on the web.
And as developers we have a responsibility to make sure that whatever user information we get we handle
it with care in a secure fashion.
And up until now I have shown you how to do a simple Sign In setup but I haven't really shown you a secure
way of doing that.
And in this video I'm going to talk about bcrypt-nodejs.
And bcrypt is a library that is very very powerful.
It allows us to create a very secure login.
Now what does that mean?
Let me show you.
Up until now we had'password' just in plain text. In real life
we are never ever storing passwords as plain texts like this just like a string into our database.
This is exactly how companies get hacked and passwords get released of users when they store it like this.
We want to store passwords in something called hashes and I'll get to what that is in a second but I
want to change the database around to show you a more realistic look of how things will be stored.
You see in our database we can have something perhaps like
'login:' and this login will contain an array of objects
that has an 'id:'
let's just say '987' with the hash which will be empty for now and then an email and this e-mail will just
reference john@gmail.com.
This is something that we'll get more into as we talk about databases.
But I want to show you – I want to demonstrate this point to you.
In order for us to handle the sensitive information, that is, if John let's say enters our site and wants
to do a Sign In he's going to give us his email plus his password, which is 'cookies'. Now, he is trusting
us with this information.
And the very first thing we want to do is – well we're definitely not going to add it as a query string
in a GET request – we're going to add it to a POST request.
So it's in the body of the request.
We also wanted to send it over HTTPS.
That is something that requires a certificate.
And we're not going to get into that but we definitely want to include it through an HTTPS request so
that it's encrypted. When he sends 'cookies'
it's going to get jumbled up and nobody in the middle can see this or they'll be able to see it but
they won't understand what it means.
And only the server once it receives this password can actually understand that this stands for 'cookies'.
All right, so one is HTTPS.
The second thing is, how do we store that password?
Well we store it in a hash, and bcrypt, the package that I was just talking about, allows us to do this.
Let me just download this package and show you how it works.
There you go.
Now with the bcrypt installed you can see over here that it has a few things we can use and I'm going to copy and paste
this and move some of this stuff around.
I'm actually going to put this at the bottom.
bcrypt gives us a way to hash a password
and a way to compare
passwords or hashes. But what does that mean?
Let's go one by one.
If I grab this function and in our '/signin'
or sorry I guess in our '/register' because that's when we give our password. In our '/register' when we run
'bcrypt.hash' and instead of 'bacon'
this is what we pass as the user's password
– if we pass the password here, well we have a couple of parameters that they give us
and these are options that we can enter.
For now we'll just leave it the way it is.
If I 'console.log' the hash that we receive in this function – so bcrypt is going to hash the password
and then return this hash – we're going to just say 'hash'.
All right so let's just see what happens here.
I'm going to Save. Then I'll run
'npm start' going back to our Postman.
If I do '/register' with Ann – I'm going to click Send
and I get 'bcrypt is not defined' because I haven't included it here.
Let's do that let's do 'const bcrypt = require('bcrypt-nodejs')'
-
Let's save that and try that again.
I'm going to click send.
We go back to the console – do you see that? We just got a hash and that is what a hash function does. A hash function
A hash function takes a string and jumbles it up in a way that there's no way I'm going to be able to
figure out that this [the hash] stands for the password 'cookies' and hash functions are one way.
That is you can enter 'cookies' and you'll get this but you'll never be able to go back.
And the other quality of hash functions is that if I now do this again with password – Oh I guess the
password for Ann was 'apples'
– if I click send I go back I see that the hash the first time and the second time are different.
And although hash functions actually always return the same thing for the same value bcrypt is a
little bit more secure than that and adds a bit of other magic to make sure that it's impossible to
ever figure out what the password is.
But now we can store this hash – this jumbled up value – in our database in here for the login and anytime
we do sign in and we want to check if the user's passwords match.
Well now – let me remove this
– we have
– let's go to '/signin' and at the top
we can compare the hashes so grabbing the hash that we had before – let's use this one
or let's use the latest one that we got.
I will replace this.
It's going to look pretty ugly but I'm going to replace this hash with this long string and I'm going
to compare
'apples' because that's what Ann's password is.
If I compare 'apples' to this hash – let's console.log.
'first guess'
we'll have the response again
– that is what we receive after bcrypt does this.
And the second time around we'll also do a 'console log' with the wrong password, which is 'veggies'
and this will be the 'second guess'.
Let's go to do a Sign In.
It doesn't really matter what it is because we're not really worried about a response.
And I get an error saying hash is not defined because I haven't updated this hash to what we just
copied before.
So let me do that.
There you go.
Let me go back click Send.
If I look back here I get
'first guess is true'
that is, 'apples' equals this hash
they gave us but 'veggies' does not equal the hash that they gave us there.
Let me close that a little bit. And bcrypt is really really powerful.
We're going to use this when we actually implement a database to our registration. Using bcrypt, which
is a tried and tested hashing package, we can safely store users' information, users' passwords into our
database and nobody even if they – even if hackers access our database – they'll have a very hard time getting
the user passwords.
They may be able to get their email addresses but never our passwords and we'll implement that in our
database using bcrypt.
But I really want to emphasize this point because security is really important.
Always send any sensitive information from the front-end to the back-end using HTTPS
in a POST body and if you get something like a password the way you store it into the database is using
something like bcrypt to generate a hash,
and every time a user signs in, check that hash with whatever the user inputted. In the next part I've
left for you
a security article that I wrote that may be a little bit advanced but I think covers the best way for
you to store user passwords – something that is overlooked quite often but again very very important if
you want to be that top developer.
I'll see in the next one. Bye-bye