How do I retrieve an encrypted password from my database with bcrypt?

Question

I have an application with a register and login form. I've managed to get the encrypted password into the database, but i can't seem to get it to work when I want to compare it when logging in. How would I implement bcrypt in my login post method?

Here is my register post where the password is stored successfully:

router.post('/register', (req, res) => {
bcrypt.hash(req.body.password, 10).then((hash) => {
    let userData = req.body;
    let user = new User(userData);
    user.password = hash;
    user.save((error, registeredUser) => {
        if (error) {
            console.log(error);
        } else {
            let payload = {subject: registeredUser._id};
            let token = jwt.sign(payload, 'secretKey');
            res.status(200).send({token});
        }
    });
  });
});

And here is my login post:

router.post('/login', (req, res) => {
let userData = req.body;

User.findOne({email: userData.email}, (error, user) => {
    if (error) {
        console.log(error);
    } else {
        if(!user) {
            res.status(401).send('Invalid Email');
        } else
        if (user.password !== userData.password) {
            res.status(401).send('Invalid Password');
        } else {
            let payload = {subject: user._id};
            let token = jwt.sign(payload, 'secretKey');
            res.status(200).send({token});
        }
    }
  });
});

Answer 1

Few things to note here.

1. Password are usually encrypted using one-way hashing function, which means you shouldn't be expecting to decrypt the saved password back to original text.

2. In a one way hash function, same hash (encryption output) is created for same input, every time. Eg: If you can encrypt the word "mysimplepassword", the output is going to be the same "xjjklqjlj34309dskjle4" (just a sample) every time.

3. The method of checking password in such scenarios is: (a) Store the encrypted password (hash) when its first provided (usually during sign up) (b) During login, receive the password as input and encrypt it using same encryption method, to obtain the hash (c) Compare the hash

If you are using bcrypt , you can use bcrypt.compare() to perform these operations

Answer 2

I figured it out and am now comparing the hashed passwords successfully. Here is the new login post:

router.post('/login', (req, res) => {
let userData = req.body;

User.findOne({email: userData.email}, (error, user) => {
    if (error) {
        console.log(error);
    } else {
        if(!user) {
            res.status(401).send('Invalid Email');
        } else {
        bcrypt.compare(req.body.password, user.password, function (err, result) {
            if (result == false) {
                res.status(401).send('Invalid Password');
            } else {
                let payload = {subject: user._id};
                let token = jwt.sign(payload, 'secretKey');
                res.status(200).send({token});
            }
        });
    }}
  });
});