In this video we're going to kick off our section on authentication and security by starting with one
of the most basic things every application should do which is securely storing users passwords.
So right now we take the password in from the user and we store it in the database exactly as they typed
it.
So if I had over two robo three teeth and go to my users collection I can view the password for each
and every user over in the database.
Right here I have the three passwords exactly as they were provided.
This is known as storing the password in plain text and for passwords.
This is a terrible idea.
Now the problem with storing plain text passwords is that most users use these same password for multiple
accounts.
So let's say our database did get hacked.
Sure someone would be able to access the task data for all of the users.
And that's definitely not ideal.
But what's worse is we've exposed the user to further hacks because now all of their credentials are
out in the open.
Someone could try to use these same credentials for online banking and email a PayPal account or something
where there's way more sensitive information than their to do list.
So we don't want to store the password in plain text because we are leaving users exposed to further
problems.
Should this information get out.
Now yes in an ideal world people would stop using these same password for all of their accounts.
And most people are definitely catching on to that.
But the vast majority of people who use the Internet for very basic things they're not as savvy as others.
They're not using something like last pass to auto generate unique secure passwords for all their accounts.
They have their birthday followed by their favorite hobby as their password.
And it's our job as developers to do our best to keep things secure in a world where we don't have complete
control over the password the user picked.
So the solution is to store not a plain text a password but a hashed password the hashed value is going
to look nothing like the plain text password.
And if someone was to hack the database and get a hold of all of the users hashed passwords they would
be useless because the algorithm we're going to use to generate it is not reversible.
So we'll learn more about all of this as we actually play around with the hashing algorithm that will
be using the algorithm that we're going to use is known as B correct.
It is a very secure widely used hashing algorithm.
It's great for all sorts of crypto graphical use cases including this one securely storing a user's
password we can get access to an implementation of the B script algorithm in our node j s code by installing
and using an NPM module.
So let's head over to the browser to check this out.
We can find it by googling NPM B crypt J S and we're looking for the B crypt J S NPM package which is
the first result right here.
Now if we head over to this we can learn a bit more about exactly what it is.
Right here it is a super popular library with about two hundred thousand weekly downloads and it's going
to give us a few functions we can use to securely store and work with passwords.
So let's go ahead and get this installed and then mess around with it inside of our code over in Visual
Studio code.
I'm going to use control C to shut down the dev server and I'll use NPM I to install B crypt J S at
the latest version two point four point three.
Now if I go ahead and run this installation command it's going to install it as a dependency in the
task manager app and once it's installed we're going to start by messing around with it right here and
index that J S then we'll actually integrate it into the application.
Once we understand how hashing works.
So right here what I'm going to do is create an async function we can use to mess around with this concept.
My function equals a new async aero function.
Then down below I'm just going to call my function.
And the reason I'm doing this is so we can use async await since what we're about to work with B crypt
J S does indeed use promises.
So we'll use a wait in order to manage those promises.
And right here we're also going to require the library.
Now I'm putting that right here just temporarily as we know we typically require things up at the top
of the file that for this a little example which we'll delete in a moment.
This is perfectly fine right here.
We're going to create a constant called B crypt and we're going to get its value as the return value
from calling require and we're gonna load in the B crypt J S library.
Now let's go ahead and start with a plain text password to get started.
We need a plain text password so let's create a variable to store that.
I'll create a password variable and we'll pick a password like Red One two three four five exclamation
mark.
Now down below that we're going to create the hashed password.
So the plaintext password is what the user provides us the hash to password is what will actually end
up story.
So right here another concept for hashed password and we're going to set this equal to and this is where
we use a method from the B script library.
It is the hash method and it returns a promise.
So right here we can go ahead and use a weight with that promise to get the result the hashed password.
So what am I going to do.
I'm going to call B crypt dot hash and we are going to provide it to arguments.
The first is the plain text password which I have access to via the password variable.
And the second is the number of rounds we want to perform.
Now the number of rounds determines how many times the hashing algorithm is executed.
And I find that a really good number is eight.
It strikes a nice balance between security and speed.
If we use too few rounds the algorithm is a bit easier to crack.
If we use too many rounds it takes so long to run that our application becomes useless.
Eight seems to strike a nice bounce between the two.
And this was the value recommended by the original creator of the algorithm.
Now down below let's go ahead and log out both password and hash password to see what we get right here
console dot log password.
Then down below console log hashed password and once we have both logged I'm going to save the file
and run the dev server from the terminal so NPM run Dev.
This is going to start up the Express application but it's also going to run our little example and
write down below what do we get.
I have my plain text password read one two three four five then I have my hashed password showing up
and this is the value that will end up storing in the database.
Now there's an important distinction between hashing algorithms and encryption algorithms with encryption
we can get the original value back.
So let's say I'm trying to encrypt these string.
Andrew the output the encrypted value would look like some random series of characters but using the
encryption algorithm I could always turn that random series of characters back in to the original value.
Andrew hashing algorithms don't work like this hashing algorithms are one way algorithms which means
we can't reverse the process.
I take a password like my pass I put it in to the end hashing algorithm and the output.
Is that really long hash this is something that we can not reverse hashing algorithms by design are
not reversible.
So there's no way to get the plain text version back out.
Now this is by design so you're probably wondering how do you do something like log in where I want
to take the password that someone provided and see if it actually matches the hash we've stored in the
database.
Well hashing algorithms like a B crypt give us a very easy way to do that.
All we do is we hash the plaintext password that they provided when logging in and we can pair that
hash with the hash stored in the database.
Now be crypt gives us a method to get that done.
This is the other method we're gonna need from the library.
So let's take a moment to explore that before worrying about implementing anything into our API right
here.
The goal is to figure out if a given password matches the hashed password that we'll say is stored in
the database.
I'm going to create a new constant for that and I'll call it something like Is match is match we'll
be true if we do have a match and the log in operation is successful and is match will be false if the
password does not match the original one used when signing up.
Now this method also returns a promise.
So I'll use a wait again.
And right here it is B crypt dot compare.
Now compare takes in two arguments.
The first is the plaintext password.
So let's say I'm logging in with red one two three four five exclamation mark.
And the second is the hash which for us would be stored in the database.
Right here though I have it accessible via that hashed password variable.
Now down below we'll go ahead and log that to see what the value of the bullion is console log is match
with that in place.
I'm going to save the program and down below we do get a boolean the Boolean true.
So right here I can see that this password is considered a match when compared to the following hash.
So behind the scenes the B script algorithm rehashed the plain text password and then it compared it
with the hash we already had in place.
Now that the passwords don't match we're gonna get false back.
So let's say I'm trying to log into someone else's account and I don't know their password.
I'll go ahead and switch it from an upper case R to a lower case r i save the program.
And now we can see that the password we provided is not a match when compared with the hash we created
earlier.
That's because the hash we created earlier was created with a different password where we had a capital
R instead of a lower case r so using B script and the hash and compare methods.
We're gonna be able to securely store passwords while still being able to figure out if someone is logging
in with the correct credentials.
Now that we've seen the basics of working with a hashing algorithm like B crypt let's go ahead and jump
into the next video and actually hash users passwords before storing them in the database.
I am excited to get to that.
So let's jump right in to the next one.