Example on how to verify a password from database

[immortalx]

I'm new to javascript so excuse me if this is trivial, it took me a while to figure it out so i think it should be good to include this in the example to save people some time.

To save the hash to db i need to convert it first to a string.
When a user logs in i need to create a new buffer with the saved hash in order to use the verify function.

Using Buffer.from returns the error
"Error: hashBuf must be HASH_BYTES (128)"
Because the buffer length is 96.

It should be something:

const savedHash = Buffer.alloc(securePassword.HASH_BYTES)
savedHash.write(dbhashedvalue)

Also from what i understand it's not possible to set the value of securePassword.HASH_BYTES right?

Thank you

[emilbayes]

Thanks for the issue! I was worried this might happen. It's because, as of current, the hash buffer is padded with zero bytes (\0) which seems to be stripped away somewhere by your database / persistence layer. So what you do is what I'd do as well. I have considered padding up the hash to HASH_BYTES if too short, but on the other hand I'm also actively trying to avoid any magic like that, to make the library as lean and predictable as possible.

The constants exposed by secure-password are not user configureable, but defined by the underlying library, libsodium.

I am working on a example HTTP server, you can see it in #8, and I will merge it as soon as I'm confident that the parallel queue has no race conditions :)

[immortalx]

Thanks for explaining it, looking forward for that merge.

Also thanks for this great project!

[mseefeldt]

Hi folks,

i stumbled into this problem as well yesterday. I use an Express/Node.js/PostgreSQL application
and found a rather simple workaround:

The buffer is not converted to a string but to base64 (buffer.toString('base64'). The encoding
function is provided by the node.js API.
This (long) string is then stored in PostgreSQL and later read back and converted back to a
buffer by using Buffer.from('base64') from node.js.
This way i can store and recover the hash pretty easy!

Encryption
encryptedPassword = pwdSecurity.hashSync(Buffer.from(password)).toString('base64');

Verification
result = pwdSecurity.verifySync(Buffer.from(reqPassword), Buffer.from(dbPassword, 'base64'));

I hope this helps to bridge the time until the announced solution is ready.

[emilbayes]

@mseefeldt That is one way to go, but it will technically consume more space than if the ASCII was stored proper (128 bytes vs 172 bytes). On the other hand, I don't know if many storage solutions and or drivers play nice with \0 bytes :)

[luispadron]

Is there any solution for this yet, besides storing as Base64? Getting same issue when saving hashed passwords as type STRING in PostgreSQL database.

Is this the correct/recommended way of storing hashed passwords? I'm new to this whole authentication thing and just messing around trying to learn how this stuff works so any pointers are appreciated.

[emilbayes]

@luispadron Specifically with Postgres I would store the hash as BYTEA since that allows storing NUL bytes. Have you tried that?

[luispadron]

That worked perfectly!

For anyone using sequelize and express, specifically, the type you want to use for the password field, is sequelize.BLOB which ends up being BYTEA for PostgreSQL instances.

Awesome talk at JSCONF by the way, I learned a ton watching it today.

[58bits]

I just bumped into this as well, and confess my preference (although maybe for no good reason?), is to store the hashed password as an ascii string in the database.

As per @immortalx - perhaps

const reBuffer = Buffer.alloc(securePassword.HASH_BYTES)
reBuffer.write(user.password)

Could be added as a helper to this module? Something like paddedBuffer?

So we could do the following...

pwd.verify(Buffer.from('input_password'), pwd.paddedBuffer(user.password))