Reputation: 1
i'm hashing the the user password using bcrypt and stored it into DB. during login i encrypt password in front end and decrypt it before compare using crypto-js and compared password with bcrypt.compare(), it will allow to login the user when its true. the above will fine, i stucked in the scenario where user login with same encrypted password many times their password replay will occure how to fix it.
hash the password and sotreit into db
exports.changePassword= function(data, callback){
bcrypt.genSalt(saltRounds, (err, salt)=> {
if(err){
return err
}
bcrypt.hash(data.new_pass, salt, function(err, hash) {
/////db query
return db.query('update user set password=?,password_flag=1 where user_code=?'
, [hash,data.user_id], callback);
});
)}
}
login code
var log = require('../logger')
var error = require('../models/error');
const encryptDecryptService = require('../services/encryptDecryptService');
exports.loing = function(data, callback) {
const passwordData = encryptDecryptService.decrypt(envConfig.ConfigParams.CYPHER_KEY.DECRYPT_KEY, req.body.password);
const password = passwordData.toString(CryptoJS.enc.Utf8);
query = 'Select r.officer_code, r.password, r.name, r.district_code, r.subdistrict_code, from user r where r.officer_cude=?';
db.query(query, [data.user_id], function(err, rows) {
if (typeof rows[0] != 'undefined') {
bcrypt.compare(password, rows[0].password, function(err, result) {
if (err) {
error.saveError(JSON.stringify(err), '/login/login');
log.error(err);
return callback(err,{status: false});
}
if (result) {
db.query('Insert into login_history(ip_address, user_id, user_type) values ("' + data.client_ip + '",' + rows[0].officer_code + ',' + data.usertype + ')', function(err, rows1) {
const JWTToken = jwt.sign({
username: rows[0].name,
_id: rows[0].officer_code,
usertype: rows[0].usertype,
district_code: rows[0].district_code,
subdistrict_code: rows[0].subdistrict_code,
project: "HORTI"
},'secret', {
expiresIn: '2h'
});
return callback(null,[{
success: 'Welcome',
token: JWTToken
}]);
});
}
else {
return callback({status: false, failed: 'Unauthorized Access'});
}
});
}
else { return callback({status: false})}
});
}
my encrypt decrypt code
const CryptoJS = require("crypto-js");
exports.decrypt= function ( passphrase , encrypted_json_string) {
const obj_json = JSON.parse(encrypted_json_string);
const encrypted = obj_json.cipherText;
const salt = CryptoJS.enc.Hex.parse(obj_json.salt);
const iv = CryptoJS.enc.Hex.parse(obj_json.iv);
const key = CryptoJS.PBKDF2(passphrase, salt, {
hasher: CryptoJS.algo.SHA512,
keySize: 64 / 8,
iterations: 10000,
});
let decrypted = CryptoJS.AES.decrypt(encrypted, key, {iv: iv});
let a = decrypted.toString(CryptoJS.enc.Utf8);
return a;
}
exports.encrypt= function(passphrase, json_string) {
const salt = CryptoJS.lib.WordArray.random(256);
const iv = CryptoJS.lib.WordArray.random(16);
const key = CryptoJS.PBKDF2(passphrase, salt, {
hasher: CryptoJS.algo.SHA512,
keySize: 64 / 8,
iterations: 10000,
});
const encrypted = CryptoJS.AES.encrypt(json_string, key, {
mode: CryptoJS.mode.CBC,
keySize: 256,
padding: CryptoJS.pad.Pkcs7,
iv: iv,
});
return JSON.stringify({
cipherText: encrypted.toString(),
salt: salt.toString(),
iv: iv.toString(),
});
}
HERE im sending data in api
{
"password": "{"cipherText":"XXXXXXXXXX","salt":"XXXX","iv":"XX"}",
"user_id": "1234",
"usertype": "1"
}
i want to fix password replay. please help
provide a way to fix the password replay with an example.
Upvotes: 0
Views: 49