来自 bcryptjs 的 bcrypt.compare 总是返回 false

Question

I am using bcryptjs on a React and Node js project but can't seem to get it to return true. On all online verifiers it returns as valid using the password and hash. I've already verified that the length is correct but can't get it to work.

My HandleSubmit function:

        event.preventDefault();
        const self = this;
        const data = `username=${encodeURIComponent(this.state['username'])}&`;
        axios.post(`/test/do_login/${data}`)
            .then(function (response) {
                console.log("RESPONSE");
                console.log(response);
                bcrypt.compare(self.state.password, response.data).then(function (result) {
                    console.log(`PW: ${self.state.password}\nDATA:${response.data}\nRES:${result}`);
                    if (result) self.setState({ loginSuccess: true });
                });
            });
    }

On the server:

const express = require('express');
const bcrypt = require('bcryptjs');
const router = express.Router();

const regexp = /=(.+?)&/g



router.post('/do_login/:data', (req, res) => {
    var con = req.app.get('con');
    var args = [...(req.params.data).matchAll(regexp)];

    console.log(args);

    var username = args[0][1];

    query = `SELECT * FROM users WHERE username="${username}";`

    con.query(query, (err, result) => {
        if (err) throw err;
        console.log(result);
        if (result.length < 1) res.send("USERNAME_INV")
        else {
            res.send(String(result[0].pw).slice(0,59)); 

        };

    });
});

module.exports = router;

I am using slice to remove the \\u000 at the end of database entry. It is stored in a BINARY(60)

Answer 1

I think you are trying to resolve this problem in the wrong way.

In your react app, just post a request with a body payload (username and password) to your server. That's it. Don't send credentials as query parameters, it is not safe.

In your nodejs app, you have to handle this call doing:

• Comparison with the password which will be hash (from your body) and the password stored in your database (hashed too)
• Send a cookie or an access_token to your react app which will be sent each time you will call your server for next requests. You have to create a middleware so as to check the cookie or the access_token.

Moreover, check your username field to avoid sql injection.