I am currently using the following setting to register new users:
app.post('/users', function(req, res) {
var user = new User();
user.username = req.body.username;
user.email = req.body.email;
crypto.randomBytes(32, function(err, buf) {
if (err) throw err;
user.salt = buf.toString('hex');
crypto.pbkdf2(req.body.password, user.salt, 25000, 512, function(err, encodedPassword) {
if (err) throw err;
user.password = (encodedPassword.toString('hex'));
user.save(function(err, user) {
if (!err) return res.send(err, 500);
return res.json(user);
});
}.bind(this));
});
});
Take a close look at this line:
user.password = (encodedPassword.toString('hex'));
This should encode the password string (which looks like binary) into a hexadecimal string. For some reason this does not work.
Why not?
Byside : What encoding is the recommendation for storing salt and password (hex, binary, base64)?
source
share