如何使用加密检查字符串是否已在 Node.js 中进行哈希处理

Question

I am developing an application in which users are allowed o change their passwords.

I am using Node.js with mongoose and crypto .

In order to generate hashes for the passwords, I've hooked into model's pre('save') event. So basically when you use this:

var user = new User({password: '123'});
user.save(); // the password will be encrypted automatically

Having the ability to change the password, I need to find a way if the user has actually changed the password or modified any other fields. Example:

var user = User.findById('1234567', function(error, user){
     user.name = 'Hello';
     user.save(); // this will hash the password again, although it is not necessary
})

I am using Node.js's module called crypto to generate hash for passwords:

crypto.pbkdf2(password, salt, 5000, 512, 'sha512', function(error, buffer){

        this.mixins.callback.call(callback, [error, buffer.toString('base64')]);

}.bind(this));

Is there a way to check if the password is already a hashed?
If not, I will generate the hash again.

Thanks

Answer 1

This is inherently bad approach. Just call the field password_hash and always pass hash explicitly. Otherwise you might accidentally begin to store unhashed password after some minor configuration change.

Also it's generally not possible to distinguish hash from unhashed string if you allow arbitrary strings as passwords.

Answer 2

Hashed string has a hash algorithm identifier prefix. You can validate by checking whether the string is starting with $2a$ or $2b$

Reference