bcrypt-nodejs比较函数始终返回false

Question

我对bcrypt-nodejs的比较功能有疑问。 即使密码正确，比较功能也会返回假值。 我已经尽力了，但我不知道我的代码有什么问题。

我的文件夹结构

src
  -config
    -config.js
  -controller
    -AuthenticationController.js
  -models
    -index.js
    -User.js
  -policies
    -AuthenticationControllerPolicy.js
  app.js
  routes.js
 package.json

我认为问题出在Models文件夹中的User.js。

user.js的

const Promise = require('bluebird')
const bcrypt = Promise.promisifyAll(require('bcrypt-nodejs'))

function hashPassword (user, options) {
  const SALT_FACTOR = 8

  if (!user.changed('password')) {
    return
  }

  return bcrypt
    .genSaltAsync(SALT_FACTOR)
    .then(salt => bcrypt.hashAsync(user.password, salt, null))
    .then(hash => {
      user.setDataValue('password', hash)
    })
}

module.exports = (sequelize, DataTypes) => {
  const User = sequelize.define('User', {
    email: {
      type: DataTypes.STRING,
      unique: true
    },
    password: DataTypes.STRING
  }, {
    hooks: {
      beforeCreate: hashPassword,
      beforeUpdate: hashPassword,
      beforeSave: hashPassword
    }
  })

  User.prototype.comparePassword = function (password) {
    return bcrypt.compareAsync(password, this.password)
  }

  User.associate = function (models) {
  }

  return User
}

AuthenticationController.js

const {User} = require('../models')
const jwt = require('jsonwebtoken')
const config = require('../config/config')

function jwtSignUser (user) {
  const ONE_WEEK = 60 * 60 * 24 * 7
  return jwt.sign(user, config.authentication.jwtSecret, {
    expiresIn: ONE_WEEK
  })
}

module.exports = {
  async register (req, res) {
    try {
      const user = await User.create(req.body)
      const userJson = user.toJSON()
      res.send({
        user: userJson
      })
    } catch (err) {
      res.status(400).send({
        error: 'This email account is already in use.'
      })
    }
  },
  async login (req, res) {
    try {
      const {email, password} = req.body
      const user = await User.findOne({
        where: {
          email: email
        }
      })

      console.log('user BEFORE', user)
      if (!user) {
        console.log('!user')
        return res.status(403).send({
          error: 'The login information was incorrect'
        })
      }

      console.log('user AFTER', user)

      const isPasswordValid = await user.comparePassword(password)
      console.log('isPasswordValid BEFORE : ', isPasswordValid)
      if (!isPasswordValid) {
        console.log('isPasswordValid AFTER : ', isPasswordValid)
        return res.status(403).send({
          error: 'The login information was incorrect'
        })
      }

      const userJson = user.toJSON()
      res.send({
        user: userJson,
        token: jwtSignUser(userJson)
      })
    } catch (err) {
      res.status(500).send({
        error: 'An error has occured trying to log in'
      })
    }
  }
}

route.js

const AuthenticationController = require('./controller/AuthenticationController')
const AuthenticationControllerPolicy = require('./policies/AuthenticationControllerPolicy')

module.exports = (app) => {
  app.post('/register',
    AuthenticationControllerPolicy.register,
    AuthenticationController.register)
  app.post('/login',
    AuthenticationController.login)
}

如果需要，您还可以检查回购。 GitHubRepo

Answer 1

bcrypt-nodejs的用法似乎是正确的。 我会验证输入的密码和数据库中的哈希是否都符合您的期望（尤其是在comparePassword函数内部），以排除是否存在数据问题。