使用Passport和密码加密的NodeJS LDAP身份验证

Question

I'm looking at PassportJS for authentication and have a login form with username and password. But if I look at the documentation, I see that the password is passed in clear text. Which means if anyone does a console.log(password), the password will be visible. How do I ensure the password submitted by login form is encrypted?

var passport = require('passport')
  , LocalStrategy = require('passport-local').Strategy;

passport.use(new LocalStrategy(
  function(username, password, done) {
    User.findOne({ username: username }, function (err, user) {
      if (err) { return done(err); }
         if (!user) {
           return done(null, false, { message: 'Incorrect username.' });
         }
      if (!user.validPassword(password)) {
         return done(null, false, { message: 'Incorrect password.' });
      }
      return done(null, user);
    });
  }
));

Answer 1

1) From the client to server

Use SSL.

2) From the server to disk / database

When creating the password, hash it first and save the hash to disk.

Later, when validating a user, compare the hash of the submitted password against the hash on disk.

From the passport-local examples it would look something like this if using bcrypt :

// Bcrypt middleware
userSchema.pre('save', function(next) {
    var user = this;

    if(!user.isModified('password')) return next();

    bcrypt.genSalt(SALT_WORK_FACTOR, function(err, salt) {
        if(err) return next(err);

        bcrypt.hash(user.password, salt, function(err, hash) {
            if(err) return next(err);
            user.password = hash;
            next();
        });
    });
});

// Password verification
userSchema.methods.comparePassword = function(candidatePassword, cb) {
    bcrypt.compare(candidatePassword, this.password, function(err, isMatch) {
        if(err) return cb(err);
        cb(null, isMatch);
    });
};

Note: you'll need to use bcrypt or some other encryption module in addition to passport-local...but that's not super complicated and the example from the passport-local repo provides pretty much all you'll need to get started.