In this video we're going to start to implement password hashing during the sign up process.
Now there are many different ways of implementing this and if you take a look online at some different
tutorials on how to implement password hashing while using Mongo DB and Mongoose you're going to see
that a lot of them recommend that you place all this password hashing logic directly into your user
model file.
So in other words inside of our models user yes we would write out a lot of code to hash the password
and then store it along with the user.
Now we are going to do something similar to that but we're going to break our logic up here into two
separate files.
We're going to make a separate file or more specifically a separate class that is just responsible for
taking a string and hashing it.
We're also going to have inside that class a function that's going to compare two different hash strings
as well.
So the majority of the actual hashing logic that actual implementation is going to be in the separate
file in a separate class and we're going to use that inside of our user model file.
The reason we're doing this is to just keep our user model file a little bit cleaner because right now
there's a lot of stuff already inside of here and a lot of the stuff is pretty confusing.
So I want to limit the complexity of this file as much as possible.
That's why we are going to place a lot of this hashing stuff in another location.
So let's get to it.
Let me show you how we're gonna build up this password hashing stuff in a separate location.
Somebody as our city directory.
I'm gonna make a new folder called services.
There's probably a better name for this folder.
I like to create a Services Directory for just a lot of kind of general purpose things that are floating
around my application.
Again probably could think of a better name but this will work for right now.
Inside there I'm gonna make a new file called Password dot.
Yes and then inside of that I'll export a new class called password and I'm going to give this class
password to different static methods.
I'm going to say static to hash we're going to receive a password as a string.
I'll make a sec separate method that's also static to compare.
This is going to take a stored password that is a string and a supply password that is a string
quick reminder on what a static method is.
Static methods are methods so we can access without creating an instance of the class.
So for example we can call both these methods right here by simply calling password dot to hash or password
Dot.
Compare this is opposed to what normal methods or instance methods such as if we had a method on here
like print to access print.
We would have to first make a new instance of password and then on there we could access print
so we're going to implement our hashing logic here and then some logic right here to actually compare
a stored password and a supplied one so for handling the two hash parts.
This is where we want to take in a plain text password and somehow hash it out a logic that we're gonna
write out inside of here is gonna be a little bit specialized.
Again I'm going to kind of assume that you have seen password hashing at least once in the past if you
haven't.
Again I recommend doing a little quick log search online look at a tutorial or two.
There's a ton of resources out there so for the most part we're just going to throw in a bunch of code
rather quickly.
At the very top I'm going to imports s script and random bytes from the built in node library of crypto.
I'm also going to get the promise of fi function from you till s script is the hashing function that
we're going to use.
Script is fantastic.
The downside to it is that it is callback based.
We want to eventually use async await.
We're doing a lot of logic inside of here.
So I got problems of fi so we can take this callback based function and turn it into a promise based
implementation which is compatible with using async await.
So I'm going to say const script async is promise of Fi s script like so.
So again just going from the callback implementation to a promise based implementation so then inside
of here we're going to generate a salt which is a part of the hashing process.
So I'll say con salt is random bytes eight to string X that's going to generate a random string for
us
and then going to do the actual password hashing process when we use s script async or really script
in general.
We get back what is called a buffer which is kind of like an array with raw data inside of it.
So we are going to create a variable right here called buff short for buffer I'm going to do it in a
s script async I'm going to pass in the password and the salt and a number of sixty four right here
we immediately get an error because we're using a wait.
So if you want to use the await syntax we need to mark the enclosing function as async as usual.
I'll do so right away now if we mouse over buffer right here.
You'll notice that unfortunately typescript is getting a little bit confused because it doesn't really
know what happened during this promise five process.
So we mouse over buffer its type is annotated as unknown typescript is saying I have no idea what is
going on here.
So we're going to fix this up by just telling typescript exactly what buffer is.
I'm going to wrap this entire a weight statement with a set of parentheses.
And then at the very end I'll put on as buffer that's telling typescript look we know what's going on
here.
This is a buffer just treat it as such.
If I now mouse over above.
Now this thing is recognized as being a buffer now finally we're going to return the hashed results
along with these salts.
I'm going to return a template string so note the back ticks here.
Not single quotes I'm going to put in here above dot to string ex because remember we are working with
a buffer which is not the same as a string.
So we have to turn it into a string then at the very end I'm going to put a dot and then put on the
rest which is our salt
OK.
So that is our two hash function it's going to take in some password or essentially any arbitrary string
generate assaults it's going to hash the password along with the salt and then we're going to return
both the hash password and the salt concatenated together and joined by a little dot.
That's pretty good.
Well let's take a quick pause right here and then we're going to implement the compare function in the
next video as well.