Hashing Passwords | Node Authentication Tutorial – Part 3

Learn the basics behind hashing users' passwords and why it is so very important to do this within any password related app.

When it comes to securing your users' passwords, it's integral, no, absolutely necessary to hash your users' passwords before storing them in a database. Hashing is the process of scrambling up a user's password into a long string of characters that's undecipherable. The interesting thing about hashing: once you put the password in the hasher, there's no way to convert it back to its original form (at least from a mathematical standpoint). This helps ensure that your users' passwords are unreadable in the off chance someone happens to stumble upon the data in your database.

Code along with me as I demonstrate how to implement hashing functionality into our user based node app.

Video Git Repo (starts at part 1):
------------------------------------------------

Node Authentication Process:
------------------------------------------
// Add our boilerplate
// 1.x Git clone express-cc repo
// 2.x Run yarn / npm install

// Create a new user in the database
// 1.x Create a form within a view
// 2.x Create route that'll process the form's post request
// 3.x Create a database connection using .env file
// 4.x Grab form input and insert into database
// 5.x Add express-validation package
// 6.x Validate user input on backend
// 7.x Validate user input on frontend
// 8.x Hash our user's password
// 9.x Store user in database

// Login user (update user session, return auth cookie)
// 1. Install passport
// 2. Configure passport with local strategy

// Protect routes and only permit entry with authorization cookie

// Create logout button

// Create login page

Video Timeline:
-----------------------------
00:50 - Why storing passwords in plain text is bad
01:36 - What is hashing?
02:35 - How to hash our users' passwords
03:05 - What is bcrypt?
06:01 - What is a salt?
07:08 - Testing out our hashing implementation

To be continued...

The Platform:
-------------------------

Each course tells a different story, and each milestone reveals a different scene. With an expansive universe to explore, you can track your progress, and gain the necessary skills needed to build your dreams.

Chris Courses Social:
-----------------------------------

Christopher Lis Social:
-------------------------------------

[chowyows]

Thank you!! Most tutorials on the web use MongoDB for their database so this series is a nice break from the norm. Your use of a relational database helped me cleanup my existing code and get everything on my postgres/node project working as intended!! Woot!

[asadawan]

This person is great. Good one man! Keep up.

[shubhamgupta]

In the query section you changed the last "password" to "hash", what if i using stored procedure, where i have to make all these changes

[ccmoret]

Hi Christ,
You are making a great work. Your tutorial is helping me a lot.
I want to know when you are thinking to release the part 4?. I will be waiting for it.
Greetings from Chile

[denistkachenko]

Great tutorial thank you, when are you planning to release the fourth part ??

[grdane]

First off, thank you so much for this awesome tutorial. I'm learning more than I would have imagined from a free resource, you're amazing. I'm hitting a bit of a snag I'm hoping you can help with. Prior to the bcrypt step, when I'm inserting passwords into the password field in MySQL, its showing up as a number and not the text like you are seeing. It shows up as Hex. Also, adding in the bcrypt step doesn't change anything. If I console log the password variable, it's correct. Its just not showing up right in the DB itself. Any ideas on how to proceed would be appreciated. Thanks again!

EDIT: Well, I'm an idiot... its the password in hex. Now to figure out why bcrypt isn't hashing it. :D

[torbenl]

Just a quick question isn't it insecure to send the blank password with the post request on the registration ?

[JerubaalXerxes]

am on a project and one of the problem i have is restricting one user from login in with the same account from different pc at the same time. I am using express-session but am failing to fix this am trying to switch to passport but since all examples are with mongodb its all over comfusing...please help

[Wanttotravel]

Node js function
That takes following input
User ID
Username
University
Timestamp
Salt
Hash type
And returns hashed string

[yatashdeepsharma]

its not working on heroku server, , Bcrypt fails ther

[Wanttotravel]

Node js function
That takes following input
User ID
Username
University
Timestamp
Salt
Hash type
And returns hashed string

[Wanttotravel]

Node js function
That takes following input
User ID
Username
University
Timestamp
Salt
Hash type
And returns hashed string