无法使用Node js验证Express中的哈希密码

Question

This is how i Hash and store my password in the Database.

NEWUSER FUNCTION

 var salt = bcrypt.genSaltSync(10);
var hash = bcrypt.hashSync(password, salt);
var query="INSERT into user(email,firstname,lastname,logintime,gender,password) VALUES('"+email+"','"+firstname+"','"+lastname+"','"+logintime+"','"+gender+"','"+hash+"')";

This is how i retrieve and check to authenticate

VALIDATE FUNCTION

var query = "SELECT password from user where email='" + email +  "'";
connection.query(query,function(err,result){
    if(err)
        {
        console.log("ERROR:"+err.message);
        }
    else
        {
        if(result.length!==0)

        {

var hash=JSON.stringify(result[0].password); console.log(hash);  
  console.log(bcrypt.compareSync(password,hash ));  
if(bcrypt.compareSync(password, hash)) { callback(err, result); }

This always shows false but if i do it this way it shows the expected result

var hash = bcrypt.hashSync("sacjap", 8);
            //var hash=JSON.stringify(result[0].password);
            console.log(hash);
            console.log(bcrypt.compareSync(password,hash ));
            if(bcrypt.compareSync(password, hash))
                {
            callback(err, result);
                }

So the problem is that whenever i get the password from the database its not working. PLZ Help

Answer 1

First of all, my answer is based on the documentation I found here: https://github.com/davidwood/node-password-hash

It seems that the password-hash module tries to call the 'split' function on the second argument you provided to the 'verify' function, assuming it is a string ( JavaScript String split function on MDN ). I think you should check the type of your 'result' variable, it looks to me like a more complex query result object returned by your database. Your provided code doesn't give me more information about what type of connection you are using here, so I can't give you a more specific answer. My approach would be to find out how to get a plain string from your 'result' variable, which then would represent the hashed password you can hand over to 'verify'. This is just a wild guess, I hope this little hint helps you to solve your problem.

Side note: The module you are using for password hashing appears to be deprecated, maybe you should look out for an alternative.