CODEWITHSUNDEEP
javascriptnode.jsexpressbcrypt
wsfuller
wsfuller

Reputation: 1840

Bcryptjs unable to compare passwords Nodejs

Having an awful time trying to compare passwords using bcryptjs so I can sign a JWT but trying to login I can't compare to sign the token and send to the client.

Problem

I can hash a password and store into the DB, where I'm having issues is using the .compare() method and passing in the hash parameter. I'm not quite sure what to pass in as the hash value.

Technology:

user.routes.js

var express     = require('express');
var router      = express.Router();
var jwt         = require('jsonwebtoken');
var bcrypt      = require('bcryptjs');
var salt        = bcrypt.genSaltSync(10);
var config      = require('../config/database');

User = require('../models/user.model.js');

// Create new User
router.post('/', function(req, res){
   var user = req.body;
   if(!req.body.email || !req.body.password){
     res.json({success: false, message: 'Please pass email and password'});
   } else {
     User.addUser(user, function(err, user){
      if(err){
        res.send(err);
      }
      bcrypt.genSalt(10, function(err, salt){
       bcrypt.hash(user.password, salt, function(err,hash){
         user.password = hash;
         user.save();
         console.log('new user', user);
         res.json({success: true, message: 'Create user successful'});
       })
      })
    });
  }
});

Getting errors during password compare:

// Authenticate a User
//email: [email protected]
//password: password
router.post('/login', function(req, res){
  User.findOne({ email: req.body.email }, function (err, user){
    if (err){
      res.send(err);
    }
    if(!user){
      res.json({ success: false, message: 'Authentication failed. User not found'});
    } else if (user) {
      // where does this hash value get defined and passed in?
      bcrypt.compare(req.body.password, hash, function(err, res){
        if(user.password != req.body.password){
          console.log('password incorrect');
        //res.json({ success: false, message: 'Authentication failed. Password incorrect'});
      } else {
          var token = jwt.sign({
              email: user.email
          }, config.secret, {
            expiresIn: 60 // expressed in seconds
          });
          console.log('token contents', token);
          res.json({
            success: true,
            message: 'Enjoy your token!',
            token: token
          });
        }
      });
    }
  });
});

Upvotes: 4

Views: 4279

Answers (1)

susoPisto
susoPisto

Reputation: 51

The hash value that you have to pass to the compare method is the one you got when you called bcrypt.hash method. I suppose you saved that hash associated to the user in some DB, so you have to get that hash and pass it to compare method as second parameter.

I think you are doing wrong the comparison in the callback of the compare method. You shouldn't compare passwords, the compare method does that for you. You just have to check if res is true or false. If it is true, then passwords are the same, other case they are different.

If you have more doubts about the implementation in this article you have a very simple example about that: https://solidgeargroup.com/password-nodejs-mongodb-bcrypt?lang=es

It is written with promises, but it's very easy to understand.

Upvotes: 3

Related Questions