All right.
So we can successfully create the user.
Everything is beautiful.
But there are two major issues with our current setup.
First one.
Is the fact that we're sending back the password.
And honestly, it's an easy fix.
We just removed that property when we're sending it back.
Now, a much bigger issue is the fact that we're saving the passwords directly in the database as strings.
And this is a major, major issue.
Because keep in mind, if someone is going to get an access to your database, they will right away
be able to get all of the passwords for users.
And also, please keep in mind that quite often people use the same password for tons of platforms.
And if your database is compromised, it's a major, major issue.
So long story short, what do we want to do?
Well, we want to hash this.
We never, ever, ever, ever want to save this as string.
This is a big, big security concern.
And in order to do that, we will use an awesome library by the name of Bcrypt JS.
Now, if you're already familiar with the libraries, you know that there is also a bcrypt.
And essentially if you're interested in the Readme, you can read the points that I laid out, why I
went with Bcrypt.
JS But just to sum it up, what you'll find over here, technically you can use either of them.
And essentially we're looking for a library.
Of course we want to install it, so we go here with NPM install Bcrypt JS and we want to import that
in the auth controller.
We're looking for Jenn Salt, which essentially just.
Creates a random value that is going to be added to the password.
Before hashing and what's really cool.
Hashing is a one way street.
So once we hash it, that's it.
It's done.
You don't see that string anymore.
And if you're wondering, well, how we can compare the passwords later when we log in, we'll actually
compare the hashed versions.
So let's try it out.
We're going to go to auth controller.
We're looking for Bcrypt.
And first I'll set it up in a register in the controller.
And then I'll move it and set it up in a utils.
Why?
Well, because that way it's easier to take it from project to project because maybe your register controller
is different in the next project, but you can always use that utils function to hash the password.
But yes, we'll start together.
So we're going to go here with Bcrypt.
From and script.js then.
Let's go to our register and essentially right after the admin one.
We'll set up over here a salt.
So this is going to be that random value which gets added to the password when we hash it.
And the default one is ten, and that's why I'll stick with it.
Please keep in mind that the bigger the value, of course, the more secure the password, but also
the longer it's going to take to hash it.
Then we want to go with another property.
In this case, we're going to go with hash password and we'll set it equal to await.
And yes, as a side note, both of these methods in this library are asynchronous.
Then let's go with Bcrypt.
The second one is hash.
So now we want to hash the password and let's pass here the req.body password since that's where it's
located.
And notice in here, I just skipped the destructuring part.
And once I have the hashed password, you can definitely log it.
But since we'll see that in response anyway, I'm going to go here with req.body then password and we'll
set it equal to the hash password.
So essentially I'm overriding this value.
So first I grab this value to get the hashed version and then I say, You know what?
In here, instead of whatever the string value I'm getting, it's going to be equal to a hashed password.
And of course, I don't need to change anything in the user dot create since I'm already passing the
entire req dot body.
Now, as far as the response, we still don't want to send back the password even though it's hashed
and the way our setup is going to work.
We'll only send the Json web token when we log in.
So what I'm trying to say is when we register, we definitely don't want to send back that user.
There's really no need on the front end.
We'll just show the message.
Yes, you successfully registered, but in order to get into our application, user will have to log
in.
So long story short, here's what we can do.
I can simply go with message and I'll say user created.
Now I think I'm going to have to do the same deal over here again.
Let's just remove since I don't want to keep.
Changing those emails when I'm sending the request.
Then let's go to the.
Register user.
Let's change it back to John because I like it better.
Then let's send it, like I said, in here.
We'll just see.
And as I note, I have a spelling error there.
In the auth one, it should be message.
And then if we take a look at the database.
We'll see over here.
Users.
And of course, now the value is hashed.
So this is the value we'll save in a database.
And with this in place now, we want to set up a utils function which will allow us to take this functionality
from project to project.