Hashed and salted password storage using inbuilt Node.js crypto library pbkdf2

Author: clintonwoo

README.md

@@ -36,10 +36,12 @@ This project is a clone of hacker news rewritten with universal JavaScript, usin
 - Docker - (Container Deployment)
 
 ### Benefits
+
 **Front End**
 - Declarative UI - (react)
 - Flux State Management - (redux)
-- GraphQL Query Colocation - (react-apollo)
+- GraphQL Fragment Colocation - (react-apollo)
+- Prefetch Page Assets - (next)
 
 **Server**
 - Universal JS - (node & express)
@@ -57,6 +59,7 @@ This project is a clone of hacker news rewritten with universal JavaScript, usin
 - Hot Module Reloading - (next)
 - Snapshot Testing - (jest)
 - Faster Package Install - (yarn)
+- JS Best Practices - (eslint)
 
 
 ### Architecture Overview

package.json

@@ -1,6 +1,6 @@
 {
   "name": "hackernews",
-  "version": "0.3.0",
+  "version": "0.4.0",
   "description": "A hacker news clone built from the ground up to demonstrate React and GraphQL",
   "engines": {
     "node": ">=6.9.4"

src/config.js

@@ -16,3 +16,9 @@ export const HOST = (process.browser && window.location.host) || `${HOST_NAME}:$
 export const APP_URI = `http://${HOST}`;
 export const GRAPHQL_URL = `${APP_URI}${graphQLPath}`;
 export const GRAPHIQL_URL = `${APP_URI}${graphiQLPath}`;
+
+/*
+  Cryptography
+  https://nodejs.org/api/crypto.html#crypto_crypto_pbkdf2_password_salt_iterations_keylen_digest_callback
+*/
+export const passwordIterations = 10000;

src/data/models/User.js

@@ -1,6 +1,13 @@
 import * as DB from '../Database';
 import * as HNDB from '../HNDataAPI';
 import cache from '../Cache';
+import {
+  createHash,
+  createSalt,
+} from '../../helpers/hashPassword';
+import {
+  passwordIterations,
+} from '../../config';
 
 export default class User {
   constructor(props) {
@@ -18,27 +25,34 @@ export default class User {
     this.likes = props.likes || [];
     this.posts = props.posts || [];
     this.password = props.password || undefined;
+    this.passwordSalt = props.passwordSalt || undefined;
   }
 
   static getUser = id => cache.getUser(id) || HNDB.fetchUser(id);
 
   static getPostsForUser = id => DB.getNewsItems()
     .filter(newsItem => newsItem.submitterId === id);
 
-  static validPassword = (id, password) => {
+  static validPassword = async (id, password) => {
     const user = cache.getUser(id);
-    if (user) return user.password === password;
+    if (user) return await createHash(password, user.passwordSalt, passwordIterations) === user.password;
     return false;
   }
 
-  static registerUser = ({ id, password }) => {
+  static registerUser = async ({ id, password }) => {
     if (id.length < 3 || id.length > 32) throw new Error('User ID must be between 3 and 32 characters.');
     if (password.length < 8 || password.length > 100) throw new Error('User password must be longer than 8 characters.');
     if (cache.getUser(id)) throw new Error('Username is taken.');
+
+    const passwordSalt = createSalt();
+    const hashedPassword = await createHash(password, passwordSalt, passwordIterations);
+
     const user = new User({
       id,
-      password,
+      password: hashedPassword,
+      passwordSalt,
     });
+
     cache.setUser(user.id, user);
     return user;
   }

src/helpers/hashPassword.js

@@ -0,0 +1,10 @@
+import crypto from 'crypto';
+
+export const createHash = (password, salt, iterations) => new Promise((resolve, reject) => {
+  const saltBuffer = typeof salt === 'string' ? Buffer.from(salt, 'base64') : salt;
+
+  const callback = (err, derivedKey) => err ? reject(err) : resolve(derivedKey.toString('base64'));
+  crypto.pbkdf2(password, saltBuffer, iterations, 512 / 8, 'sha512', callback);
+});
+
+export const createSalt = () => crypto.randomBytes(128).toString('base64');

src/server.js

@@ -47,7 +47,7 @@ app.prepare()
     passport.use(new LocalStrategy(
       (username, password, done) => {
         const user = User.getUser(username);
-        // if (err) { return done(err); }
+        // if (err) return done(err);
         if (!user) {
           return done(null, false, { message: 'Incorrect username.' });
         }
@@ -83,14 +83,18 @@ app.prepare()
     server.use(bodyParser.urlencoded({ extended: false }));
     server.use(passport.session());
 
-    server.post('/login', (req, res, next) => {
+    server.post('/login', async (req, res, next) => {
       if (req.body.creating) {
         if (!req.user) {
-          User.registerUser({
-            id: req.body.username,
-            password: req.body.password,
-          });
-          req.session.returnTo = `${req.body.goto}${req.body.username}`;
+          try {
+            await User.registerUser({
+              id: req.body.username,
+              password: req.body.password,
+            });
+            req.session.returnTo = `${req.body.goto}${req.body.username}`;
+          } catch (err) {
+            req.session.returnTo = '/login?how=user';
+          }
         } else req.session.returnTo = '/login?how=user';
       } else req.session.returnTo = req.body.goto;
       next();