bcrypt nodejs不断返回false

Question

I have been struggling with this for hours and have tried a lot of different variations I have found around the web and also on stack overflow but I keep getting stuck on the same thing.

This is my registration code:

// REGISTER USER
app.post("/register", async (request, response) => {
    const saltRounds = 10;
    const emailAddress = request.body.emailAddress;
    const password = await bcrypt.hash(request.body.password, saltRounds);

    console.log(password)

    // CHECK IF A USER EXISTS
    const sqlSearch = "SELECT * FROM users WHERE emailAddress = ?"
    const search_query = mysql.format(sqlSearch, [emailAddress])

    // INSERT NEW USER
    const sqlInsert = "INSERT INTO users (emailAddress, password) VALUES (?,?)"
    const insert_query = mysql.format(sqlInsert, [emailAddress, password])

    await usersDB.query(search_query, async (err, result) => {
        if (err) throw (err)
        if (result.length != 0) {
            console.log("------> User already exists")
            response.send("exists")
        } else {
            await usersDB.query(insert_query, (err, result) => {
                if (err) throw (err)
                response.send("created")
            })
        }
    })
})

This is my login code:

// LOGIN (AUTHENTICATE USER)
app.post("/login", async (request, response) => {
    const emailAddress = request.body.emailAddress
    const password = request.body.password

    const sqlSearch = "SELECT * FROM users WHERE emailAddress = ?"
    const search_query = mysql.format(sqlSearch, [emailAddress])

    await usersDB.query(search_query, async (err, result) => {
        if (err) throw (err)
        if (result.length == 0) {
            console.log("--------> User does not exist")
            response.sendStatus(404)
        } else {
            // Get the hashed password from result
            const hashedPassword = result[0].Password

            await bcrypt.compare(password, hashedPassword, function(err, result) {
                if (result) {
                    console.log("---------> Login Successful")
                    response.send(`${emailAddress} is logged in!`)
                } else {
                    console.log("---------> Password Incorrect")
                    console.log(password)
                    console.log(hashedPassword)
                    response.send("Password incorrect!")
                }
            });
        }
    })
})

I don't really understand what is going wrong in the compare considering the hashes are the same, I also tried pulling the salt rounds out and declaring them as a variable as you can see, this was recommended on another answer. I have changed the compare await in several different ways but they all give the same result.

I did also check the typeof on each var and they are all strings as they need to be.

My output: The first hash you see is what is going into the database, the password being "test" and the second hash is from the compare statement along with the plaintext being shown.

$2b$10$wXGSrneIiovWHG7wk6a0BOIXwhzelTlCcxeoLsVJ8Au4iiOcoBBhe
---------> Password Incorrect
test
$2b$10$wXGSrneIiovWHG7wk6a0BOIXwhzelTlCcxeoLsVJ8Au4iiOcoBBhe

Any help would be greatly appreciated.

Note: The password column in my DB is a VARCHAR(255)

Answer 1

You can make a 2 seperate function for achieve the bcrypt functions. Here is the helper file which holds the bcrypt functions

const logger = require('./logger');
const bcrypt = require('bcrypt');


const encryptUtil = {};

// It make a hash password
encryptUtil.oneWayEncrypt = async (text) => {
  try {
    const salt = await bcrypt.genSalt(parseInt(process.env.SALT_ROUND, 10));
    const encoded = await bcrypt.hash(text, salt);
    return { encoded, salt };
  } catch (err) {
    logger.error('[ERROR] From oneWayEncrypt in encryptUtils', err);
    throw err;
  }
};

// It will validate plain text with the hashed one
encryptUtil.validateBcryptHash = async (text, hash) => {
  try {
    const isExactMatch = await bcrypt.compare(text, hash);
    return isExactMatch;
  } catch (err) {
    logger.error('[ERROR] From validateBcryptHash in encryptUtils', err);
    throw err;
  }
};

module.exports = encryptUtil;

Here is the usecase of that function in signup and login

const encryptUtil = require('../../../helper/encryptUtil');
const logger = require('../../../helper/logger');
const jwt = require('../../../helper/jwt');

const userUtils = {};

userUtils.signUp = async (obj) => {
  try {
    const { name, password } = obj;
    const email = obj.email.toLowerCase();
    const condition = { email };
    const querying = {
      attributes: ['id', 'name', 'email''],
      where: { email },
    };
    const isEmailExist = await Model.user.findOne(querying);
    if (isEmailExist) {
      const errorObj = { code: 400, error: l10n.t('ERR_EMAIL_ALREADY_EXIST') };
      throw errorObj;
    }
    const { encoded: encPassword } = await encryptUtil.oneWayEncrypt(password);
    const insertObj = {
      name,
      email,
      password: encPassword,
    };
    const result = await Model.user.create(insertObj);
    const userId = result.id;
    const token = jwt.getAuthToken({ userId });
    return { token, msg: l10n.t('MSG_SIGNUP_SUCCESS'), user: { name, email, userId } };
  } catch (error) {
    logger.error('[ERROR] From signUp in userUtils', error);
    throw error;
  }
};

userUtils.login = async (obj) => {
  try {
    const { password } = obj;
    const email = obj.email.toLowerCase();
    const querying = {
      attributes: ['id', 'name', 'email', 'password'],
      where: { email },
    };
    const user = await Model.user.findOne(querying);
    if (!user) {
      const errorObj = { code: 400, error: l10n.t('ERR_CREDENTIAL_NOT_MATCHED') };
      throw errorObj;
    }
    // Here it validates the simple text with hashed text which store in a dbatabase
    const isExactMatch = await encryptUtil.validateBcryptHash(password, user.password);
    if (!isExactMatch) {
      const errorObj = { code: 400, error: l10n.t('ERR_CREDENTIAL_NOT_MATCHED') };
      throw errorObj;
    }
    const token = jwt.getAuthToken({ userId: user.id });
    const result = {
      token,
      user: {
        userId: user.id,
        name: user.name,
        email: user.email,
    };
    return result;
  } catch (error) {
    logger.error('[ERROR] From login in userUtils', error);
    throw error;
  }
};

module.exports = userUtils;