15

I am using passport-local strategy of passport for authentication. In my express server, I am getting a register post request and I should save password to db for a new user. But I need to hash the password before saving to db.

But I am not sure how to hash it, since passport will authenticate user by hashing the login password credential to match my hashed password from db. How should I hash my passwords ?

I am using this module.

3 Answers 3

29

passport-local does not hash your passwords - it passes the credentials to your verify callback for verification and you take care of handling the credentials. Thus, you can use any hash algorithm but I believe bcrypt is the most popular.

You hash the password in your register handler:

app.post('/register', function(req, res, next) {
  // Whatever verifications and checks you need to perform here
  bcrypt.genSalt(10, function(err, salt) {
    if (err) return next(err);
    bcrypt.hash(req.body.password, salt, function(err, hash) {
      if (err) return next(err);
      newUser.password = hash; // Or however suits your setup
      // Store the user to the database, then send the response
    });
  });
});

Then in your verify callback you compare the provided password to the hash:

passport.use(new LocalStrategy(function(username, password, cb) {
  // Locate user first here
  bcrypt.compare(password, user.password, function(err, res) {
    if (err) return cb(err);
    if (res === false) {
      return cb(null, false);
    } else {
      return cb(null, user);
    }
  });
}));
1
  • 2
    How do I this with passport-local-mongoose package which hashes with PBKDF2 and not bcrypt? Jul 19, 2018 at 6:36
3

Have you tried this?

https://www.npmjs.com/package/passport-local-authenticate

var auth = require('passport-local-authenticate');

auth.hash('password', function(err, hashed) {
  console.log(hashed.hash); // Hashed password
  console.log(hashed.salt); // Salt
});

auth.hash('password', function(err, hashed) {
  auth.verify('password', hashed, function(err, verified) {
    console.log(verified); // True, passwords match
  ));
});

auth.hash('password', function(err, hashed) {
  auth.verify('password2', hashed, function(err, verified) {
    console.log(verified); // False, passwords don't match
  ));
});
4
  • Hey man, I have edited my post with the module I am using, your link is a different module. It might apply to mine.
    – FurkanO
    Jun 7, 2016 at 0:22
  • @FurkanO If you want the ability to hash the password then you'll need to use the module I've linked.
    – gotnull
    Jun 7, 2016 at 0:32
  • But mine does authentication too, it should require a type of hash algorithm too. I guess there is a standart way everybody knows or sth. But If nobody answers I ll use yours. Thanks for your post.
    – FurkanO
    Jun 7, 2016 at 0:34
  • @FurkanO You can use both modules -- the password-local-authenticate module uses the following to hash the password: nodejs.org/api/…
    – gotnull
    Jun 7, 2016 at 0:35
2

Why should we go for hashing algorithm, when passport already provided it for us? I mean we just need to plugin the passport-local-mongoose to our user schema like: UserSchema.plugin(passportLocalMongoose) and then, inside the register route we just tell the passportLocalMongoose to do the hashing for us by using:

User.register(new User({username:req.body.username}), req.body.password,function(err,newUser)
{ 
    if(err){
        something
    }else{
        something
    }
)

By doing above we don't need to take care of hashing and it will be done for us. Please correct me if I am wrong or got your question wrong.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.