Agenda

<aside> 📌 Reminders

• Submit lab by October 13, 2024
• A2 due October 6, 2024 </aside>

Storing and Verifying Passwords as Salted Hashes

What is a Salted Hash?

A hash is a one-way cryptographic function that converts data (like passwords) into a fixed-length string. A salt adds random data to the password before hashing it, increasing its security by preventing attacks like dictionary and rainbow table attacks.

• Why Use Salted Hashes?

Storing passwords in plaintext is insecure. Storing passwords as salted hashes ensures that even if the database is compromised, attackers can't easily reverse-engineer the passwords.

• How to Implement:

Using the bcrypt package, you can hash passwords and store them in a secure way. When users sign in, the stored hash is compared with the hash of the provided password.

import { compare, genSalt, hash } from "bcrypt";

// Generating a salted hash

genSalt(10, function (err, salt) {

hash(password, salt, function (err, hash) {

// Store hash in the database

});

});

// Verifying password during sign in

compare(password, storedHash, function(err, result) {

if (result) {

// Password matches

}

});

Stateful Authentication Using Session Cookies

• What is Stateful Authentication? Stateful authentication allows users to authenticate once and remain authenticated across multiple requests. This is achieved by creating a session on the server that stores the user's data (such as username) and associates it with a unique session ID in the user's browser.
• Sessions vs Cookies: Instead of storing sensitive data like usernames in cookies, it is better to use server-side sessions. The session is identified by a cookie containing a session ID, but the actual user data stays on the server.
• How to Implement: Use the express-session middleware to create a session when the user signs in.

import session from "express-session";

app.use(

session({

secret: "please change this secret",

resave: false,

saveUninitialized: true,

})

);

// Store username in session

req.session.username = "user123";

Authorization

• What is Authorization? Authorization determines what authenticated users are allowed to do. In this lab, you will implement role-based permissions that allow or restrict users' actions based on their authentication status.
• Security Policy:
  1. View messages: All users (authenticated or not) can view messages.
  2. Upvote/Downvote: Only authenticated users can upvote/downvote.
  3. Delete messages: Only authenticated users can delete their own messages.
• How to Implement: Use middleware to check if a user is authenticated before allowing certain actions.

function isAuthenticated(req, res, next) {

if (!req.session.username) return res.status(401).end("access denied");

next();

}

// Example of protecting a route

app.post('/api/messages/', isAuthenticated, function (req, res) {

// Only authenticated users can post messages

});