Nsryjdtyk

I am looking for a good way to save an Account to MongoDB using mongoose.

My problem is: The password is hashed asynchronously. A setter wont work here because it only works synchronous.

I thought about 2 ways:

• Create an instance of the model and save it in the callback of the
  hash function.




• Creating a pre hook on 'save'

Is there any good solution on this problem?

The mongodb blog has an excellent post detailing how to implement user authentication.

http://blog.mongodb.org/post/32866457221/password-authentication-with-mongoose-part-1

The following is copied directly from the link above:

User Model

var mongoose = require('mongoose'),

    Schema = mongoose.Schema,

    bcrypt = require('bcrypt'),

    SALT_WORK_FACTOR = 10;



var UserSchema = new Schema({

    username: { type: String, required: true, index: { unique: true } },

    password: { type: String, required: true }

});





UserSchema.pre('save', function(next) {

    var user = this;



    // only hash the password if it has been modified (or is new)

    if (!user.isModified('password')) return next();



    // generate a salt

    bcrypt.genSalt(SALT_WORK_FACTOR, function(err, salt) {

        if (err) return next(err);



        // hash the password using our new salt

        bcrypt.hash(user.password, salt, function(err, hash) {

            if (err) return next(err);



            // override the cleartext password with the hashed one

            user.password = hash;

            next();

        });

    });

});



UserSchema.methods.comparePassword = function(candidatePassword, cb) {

    bcrypt.compare(candidatePassword, this.password, function(err, isMatch) {

        if (err) return cb(err);

        cb(null, isMatch);

    });

};



module.exports = mongoose.model('User', UserSchema);

Usage

var mongoose = require(mongoose),

    User = require('./user-model');



var connStr = 'mongodb://localhost:27017/mongoose-bcrypt-test';

mongoose.connect(connStr, function(err) {

    if (err) throw err;

    console.log('Successfully connected to MongoDB');

});



// create a user a new user

var testUser = new User({

    username: 'jmar777',

    password: 'Password123';

});



// save user to database

testUser.save(function(err) {

    if (err) throw err;

});



// fetch user and test password verification

User.findOne({ username: 'jmar777' }, function(err, user) {

    if (err) throw err;



    // test a matching password

    user.comparePassword('Password123', function(err, isMatch) {

        if (err) throw err;

        console.log('Password123:', isMatch); // -> Password123: true

    });



    // test a failing password

    user.comparePassword('123Password', function(err, isMatch) {

        if (err) throw err;

        console.log('123Password:', isMatch); // -> 123Password: false

    });

});

I think this is a good way by user Mongoose and bcrypt！

User Model

/**

 * Module dependences

*/



const mongoose = require('mongoose');

const Schema = mongoose.Schema;

const bcrypt = require('bcrypt');

const SALT_WORK_FACTOR = 10;



// define User Schema

const UserSchema = new Schema({

    username: {

        type: String,

        unique: true,

        index: {

            unique: true

        }

    },

    hashed_password: {

        type: String,

        default: ''

    }

});



// Virtuals

UserSchema

    .virtual('password')

    // set methods

    .set(function (password) {

        this._password = password;

    });



UserSchema.pre("save", function (next) {

    // store reference

    const user = this;

    if (user._password === undefined) {

        return next();

    }

    bcrypt.genSalt(SALT_WORK_FACTOR, function (err, salt) {

        if (err) console.log(err);

        // hash the password using our new salt

        bcrypt.hash(user._password, salt, function (err, hash) {

            if (err) console.log(err);

            user.hashed_password = hash;

            next();

        });

    });

});



/**

 * Methods

*/

UserSchema.methods = {

    comparePassword: function(candidatePassword, cb) {

        bcrypt.compare(candidatePassword, this.password, function(err, isMatch) {

            if (err) return cb(err);

            cb(null, isMatch);

        });

    };

}



module.exports = mongoose.model('User', UserSchema);

Usage

signup: (req, res) => {

    let newUser = new User({

        username: req.body.username,

        password: req.body.password

    });

    // save user

    newUser.save((err, user) => {

        if (err) throw err;

        res.json(user);

    });

}

Result

Result

The Mongoose official solution requires the model to be saved before using the verifyPass method, which can cause confusion. Would the following work for you? (I am using scrypt instead of bcrypt).

userSchema.virtual('pass').set(function(password) {

    this._password = password;

});



userSchema.pre('save', function(next) {

    if (this._password === undefined)

        return next();



    var pwBuf = new Buffer(this._password);

    var params = scrypt.params(0.1);

    scrypt.hash(pwBuf, params, function(err, hash) {

        if (err)

            return next(err);

        this.pwHash = hash;

        next();

    });

});



userSchema.methods.verifyPass = function(password, cb) {

    if (this._password !== undefined)

        return cb(null, this._password === password);



    var pwBuf = new Buffer(password);

    scrypt.verify(this.pwHash, pwBuf, function(err, isMatch) {

        return cb(null, !err && isMatch);

    });

};

I guess it would be better to use the hook, after some research i found

http://mongoosejs.com/docs/middleware.html

where it says:

Use Cases:

asynchronous defaults

I prefer this solution because i can encapsulate this and ensure that an account can only be saved with a password.

Another way to do this using virtuals and instance methods:

/**

 * Virtuals

 */

schema.virtual('clean_password')

    .set(function(clean_password) {

        this._password = clean_password;

        this.password = this.encryptPassword(clean_password);

    })

    .get(function() {

        return this._password;

    });



schema.methods = {



    /**

     * Authenticate - check if the passwords are the same

     *

     * @param {String} plainText

     * @return {Boolean}

     * @api public

     */

    authenticate: function(plainPassword) {

        return bcrypt.compareSync(plainPassword, this.password);

    },



    /**

     * Encrypt password

     *

     * @param {String} password

     * @return {String}

     * @api public

     */

    encryptPassword: function(password) {

        if (!password)

            return '';



        return bcrypt.hashSync(password, 10);

    }

};

Just save your model like, the virtual will do its job.

var user = {

    username: "admin",

    clean_password: "qwerty"

}



User.create(user, function(err,doc){});

For those who are willing to use ES6+ syntax can use this -

const bcrypt = require('bcryptjs');

const mongoose = require('mongoose');

const { isEmail } = require('validator');



const { Schema } = mongoose;

const SALT_WORK_FACTOR = 10;



const schema = new Schema({

  email: {

    type: String,

    required: true,

    validate: [isEmail, 'invalid email'],

    createIndexes: { unique: true },

  },

  password: { type: String, required: true },

});



schema.pre('save', async function save(next) {

  if (!this.isModified('password')) return next();

  try {

    const salt = await bcrypt.genSalt(SALT_WORK_FACTOR);

    this.password = await bcrypt.hash(this.password, salt);

    return next();

  } catch (err) {

    return next(err);

  }

});



schema.methods.validatePassword = async function validatePassword(data) {

  return bcrypt.compare(data, this.password);

};



const Model = mongoose.model('User', schema);



module.exports = Model;