Authentication in Node.js - #7 Login & Logout

In this video, we are going to implement login and logout functionality in our app. At a high level, the authentication flow goes like this. When the user signs in, we validate their email address and password, match them with a user in our database, create a session in cache, and issue a session cookie. When the user logs out, we destroy the session and unset the cookie. Both routes should be behind guest and auth middleware respectively, since only a guest should be able to log in and only a logged in user can sign out.

One security flaw that we will highlight is the time difference between querying a user document and matching its hash with the password. Our if-conditional will first check if the user document is falsy, and if it is, that is MongoDB couldn't match the email with any existing user, then it will skip the second check and throw an exception early. However, if the email was found, it will compare the user's hash with the given password using bcrypt, and because hashing consumes many CPU cycles, the server would take up more time to respond. The delta is only a few hundred milliseconds, but it's enough for an attacker to infer that that particular email and password combination triggered a separate logical branch.

[santhosh]

Detailed video indeed. I'd also like to point out that, Most of the time, you are just saying what you are typing and not why you are using so and so method etc

[AndersonSilvaMMA]

Wow, the quality level of this video is so high! Thanks

[MangoDeveloper]

Hey, good work. It would be nice to see you talking about PM2.

[edmilinski]

very impressive. a few months ago I watched some of your videos and could not follow, you were way too fast. This series is just right, I still need to pause it sometimes to inspect what was done, but this is excellent. maybe finish with a short recap what was done, why ... maybe that would help us remember more. cheers

[BaalAsh]

thank you for this video.
i have a question: why do you check email and password to logout ?
is there a simple way to just "destroy" the user ? by removing his token for example if you use jwt

[vigneshpugaz]

Is it necessary to store userId in sessions on registeration?

[НинаКоваленко-ък]

Hey guy, look more often at the camera and where are the emotions?😄😅