当密码包含数字时，bcryptjs 比较 function 返回 false

Question

I have used bcryptjs to hash my passwords and the registration of the user takes place fine. But when I try to login, the bcrypt.compare function returns a false promise if the passwords contain numbers or other characters.
Everything works fine if the password is just letters.
I have searched everywhere but could not find a solution for this error?
Here are my files:

users.js (MODEL)

var mongoose = require("mongoose");
var bcrypt = require("bcryptjs");

var userSchema = mongoose.Schema({
    name: String,
    email: String,
    password: String,
    products: [{
        type: mongoose.Schema.Types.ObjectID,
        ref: "Product"
    }],
    username: String
});

var User = module.exports = mongoose.model("User", userSchema);
module.exports.createUser = function(newUser, callback) {
    bcrypt.genSalt(5,function(err,salt){
        bcrypt.hash(newUser.password,salt,function(err,hash){
            newUser.password = hash;
            newUser.save(callback);
        });
    });
}

module.exports.comparePassword = function(candidatePassword, hash, callback){
    bcrypt.compare(candidatePassword, hash, function(err, isMatch) {
      if(err) throw err;
      console.log(isMatch);
      callback(null, isMatch);
    });
  }
  module.exports.getUserByUsername = function(username, callback){
    var query = {username: username};
    User.findOne(query, callback);
  }

app.js

app.use(passport.initialize());
app.use(passport.session());
var LocalStrategy = require("passport-local").Strategy;
passport.use(new LocalStrategy(
    function(username, password, done) {
        User.findOne({username:username}, function(err, user){
            if(err) throw err;
            if(!user) {
                return done(null,false, {message: 'Unknown user'});
            }
            User.comparePassword(password,user.password,function(err, isMatch){
                if(err) {
                    console.log("ERR1");
                    return done(err);
                }
                if(isMatch) {
                    console.log("MATCH");
                    return done(null,user);
                } else {
                    console.log("NOT VALID");
                    return done(null, false, {message: 'Invalid password'});
                }
            });
        });
    }
));

passport.serializeUser(function(user,done){
    done(null,user.id);
});
passport.deserializeUser(function(id,done){
    User.getUserById(id, function(err,user){
        done(err,user);
    })
})

users.js (ROUTE)

router.post("/login", passport.authenticate('local', function (error, user, info){
    if(error) {
        console.error(error);
            console.log('Failed login:');
    }
    if (user === false) {
        console.log("user not found");
    } else {
        // handle successful login ...
        console.log("logged in");
    }
}), function (req, res) {
    res.send(req.user);
});

router.post("/signup", function (req, res) {
    console.log(req.body);
    var password = req.body.password;
    var password2 = req.body.password2;
    if(password == password2) {
        var newUser = new User ({
            name: req.body.name,
            email: req.body.email,
            username: req.body.username,
            password: req.body.username
        });

        User.createUser(newUser, function(err, user){
            if(err)
                throw err;
            console.log(user);
            res.send(user).end();   
        });
    } else {
        res.status(500).send("{errors: \"Passwords don't match\"}").end()
    }
});

Whenever I enter a password that contains numbers, I get

false
NOT VALID
user not found

I'm sorry if I have done or not done something extremely simple. This is my first time using bcryptjs. All answers are appreciated!

Answer 1

In the users.js file at the comparePassword function inside the compare method of bcrypt you are throwing the error instead of passing it to the callback. Maybe if you make this change:

module.exports.comparePassword = function(candidatePassword, hash, callback){
    bcrypt.compare(candidatePassword, hash, function(err, isMatch) {
      console.log(isMatch);
      callback(err, isMatch);
    });
}

You will see what kind of error it's generated by the case when you introduce numbers in your passwords.