Instructor: In the last section,
we took a look at Robomongo
and we saw that we were storing our passwords in plain text.
This opens us up to a huge security vulnerability
where if a malicious actor ever got access to our database,
they could see all of our users plain text passwords.
So we decided that we need to somehow
encrypt these passwords before they got saved.
To do so, we installed the bcrypt library
and then we added a whole bunch of code
inside of our user model with the explanation of...
Well, we'll talk about what it's doing later.
So... (laughs)
It's now that time, let's talk about exactly
what this code here is doing.
I'm gonna break this up into a couple different steps
and we're gonna break it up using comments.
So the first comment I'm gonna add is,
before saving a model, run this function.
That's the first thing that happens here.
This userschema.pre and then save, literally means presave
or before the model gets saved, run this function.
So this is a hook of sorts
that runs before the user ever gets saved.
Inside of the function,
there's a little bit of a gotcha here
but the context of this function is the user model.
So this right here, this line right here,
is basically, it's just getting access to the user model.
That's all that's happening here.
I know this probably looks a little bit weird
but just take my word for it.
We're going to get access to the user model.
So at this point in time,
user is an instance of the user model.
So it's an instance that has a very specific username
or excuse me, a very specific email and password
that we could reference if we wanted to
using user.email or user.password.
(keys clacking)
Then we started to make use of the bcryt library.
And I've got a great diagram
that's gonna explain exactly what's going on.
But first, let's put a little bit of comments in here
to explain it.
First, we're going to generate a salt.
And we're gonna talk about what a salt is, bear with me.
After we generate a salt, it takes some amount of time.
So it takes, you know, some number of milliseconds
to generate a salt.
So rather than say, genSalt
and then, in the line beneath it, you know, xyz,
whatever else afterwards,
because it takes some amount of time
we're gonna pass a callback function
that genSalt should run after the salt has been created.
So I'm gonna say, generate a salt then run callback.
After the salt has been created,
we've got the variable right here, this is our salt,
we're then going to hash our password using the salt.
And by hash, I basically really mean encrypt.
So hash or encrypt our password using this salt.
That gives us another callback
because this is also gonna take some amount of time to run.
So, we get another callback.
The result of which is the hash
which is is basically, our encrypted password.
So down here, we're going to overwrite plain text password
with encrypted password.
Then as a very final step,
we say, next, which basically means
go ahead and save the model.
So, this was a presave hook.
We say next to say, go ahead, you can save the model.
That's totally fine, go for it.
All right, so we got some number of comments in here.
Let's first test this out and make sure that, you know...
I just wanna see in Robomongo.
I wanna see like encrypted password
or some password that's really hard to read.
So, I'm gonna flip back over to postman.
I'm going to change my email slightly,
just to get a unique email.
I'll save it.
And I still have success true. Perfect.
Let's flip back over to Robomongo.
I'm gonna refresh with Command + R.
Here's my new user.
And I can now see that my password
is not the simple string 123
but it's this really long string of characters.
If I right click and then hit edit document, you can see...
Wow. Yeah, there's a lot of stuff going on here.
This is definitely something encrypted at this point.
So, let's talk about bcrypt and exactly what it's doing.
This is a diagram that summarizes the bcrypt process.
There's really two-steps to bcrypt.
First, saving a password,
which is the code that we just wrote.
And then, there is comparing a password,
like when we want to sign in.
So, we're not quite at this step yet.
We're not on step two yet, we're still on step one.
So, let's focus on everything up here.
And then, when we do the our sign in logic,
we will go over that additional content here.
So when we save a password, we generate a salt.
A salt is just an encrypted string
or it is a string of characters,
a randomly generated string of characters.
By combining a salt and a plain password,
we get a hashed password.
When we look in Robomongo
and we got this long string of characters right here,
this long string of characters
contains both the salt and the hashed password.
So, remember we generated a salt,
we took the password as well,
we hashed the password.
This long string right here, contains the hash password
but it also contains the salt.
So in other words, this string of characters right here,
contains two values, it contains our salt
and our encrypted password.
Two things.
You might be wondering.
Okay, what's the point of this?
Why do we have two characters or two separate variables
inside the string right here?
The answer is that it's very important
when we go to sign in a user.
And we'll talk about exactly what's going on here.
But all I want you to know for right now
is that as we are saving our password, we generate a salt,
We take our plain password
we encrypt the password into a hash password.
And then, we save into the database
the salted version, or excuse me,
the salt plus the hashed password.
Okay.
So with a little bit more knowledge of what's going on here,
let's continue in the next section
where we will start working on our sign in route.
I'll see you there.