How to Sign In with raw password when password stored in the database is hashed in Node.js

A guide on how to authenticate users signing in by comparing a raw password with the hashed password stored in the database. It demonstrates using `bcrypt` in Node.js to check if the raw password matches the hashed one.

This article will explain how to authenticate users in Node.js when their passwords are stored in the database as hashed values. We'll use the bcrypt library to compare the raw password entered by the user with the hashed password.

JavaScript Code

// Import necessary libraries
const bcrypt = require('bcrypt');
const express = require('express');
const bodyParser = require('body-parser');

// Initialize express application
const app = express();
app.use(bodyParser.json());

// Assume this is the hashed password stored in the database
const storedHashedPassword = '$2b$10$eW5OoANrF5OYsXBXFBDyYeZG96V8uAblEUHhPzBwdKa5wqlXpoGva'; // Hash of 'mypassword'

// Login function
app.post('/login', async (req, res) => {
    const { password } = req.body; // Receive raw password from POST request

    try {
        // Compare the raw password with the hashed password
        const match = await bcrypt.compare(password, storedHashedPassword);

        if (match) {
            // If passwords match
            res.send('Login successful!');
        } else {
            // If passwords do not match
            res.status(400).send('Incorrect password.');
        }
    } catch (error) {
        res.status(500).send('An error occurred.');
    }
});

// Listen on port 3000
app.listen(3000, () => {
    console.log('Server is running on port 3000');
});

Detailed explanation:

1. const bcrypt = require('bcrypt');: Imports the bcrypt library for hashing and comparing passwords.
2. const express = require('express');: Imports the express library to create an HTTP server.
3. app.use(bodyParser.json());: Uses body-parser to handle data from POST requests as JSON.
4. const storedHashedPassword = '...': Assumes this is the hashed password stored in the database.
5. app.post('/login', ...): Defines the /login endpoint to handle sign-in requests.
6. const match = await bcrypt.compare(password, storedHashedPassword);: Compares the raw password with the hashed password.
7. if (match): If the password matches, sends a success message.
8. else: If it doesn't match, returns a login error.
9. app.listen(3000, ...): Starts the server on port 3000.

System requirements:

• Node.js version 12 or higher.
• bcrypt library: Used for hashing and comparing passwords.
• express library: Used to create an HTTP server.
• body-parser library: Used to process POST request data.

How to install the libraries:

npm install bcrypt express body-parser

Tips:

• Use a higher number of bcrypt rounds (minimum 10) to enhance the security of the hashing process.
• Never store raw passwords in the database.

---