Question

我在我的数据库中验证了我正在保存密码的用户名和哈希值。我能够从数据库中检索名称，但是当我检查密码时，它总是返回false。不确定是什么问题。

这是我的HTML

<div ng-controller="userController"> 
    <div class=user>
        <form name="login_form">
            <h2 class>Login</h2>
            <h3 class = "login_page">UserName</h3>
            <input ng-model="user" type="text" ng-minlength="1" required>
            <h3 class = "login_page">Password</h3>
            <input ng-model="password" type="password" name="password" ng-minlength="4" required>
            <input type="submit" value="Login" ng-click="login()" >
            <div ng-if ="login_form.$submitted" ng-messages="login_form.password.$error" style="color:maroon" role="alert">
                <div ng-message="minlength">Your field is too short</div>
            </div>
            <p ng-if="error">Username or login is incorrect</p>
        </form>
    </div>
    <div class=user>
        <form name = "register_form">
            <h2 class>Register</h2>
            <h3 class = "login_page">UserName</h3>
            <input ng-model="reg.name" type="text" required>
            <h3 class = "login_page">Password</h3>
            <input ng-model="reg.password" type="password">
            <input type="submit" value="Register" ng-click="register()" required >
            <div ng-if ="login_form.$submitted" ng-messages="login_form.password.$error" style="color:maroon" role="alert">
                <div ng-message="minlength">Your field is too short</div>
            </div>
            <p ng-if="duplicate">That user name is taken, please choose another</p>
            <p ng-if="correct">Registration Succesfull</p>
        </form>
    </div>
</div>

这是我服务器端的控制器

var mongoose = require('mongoose'),
Todo = mongoose.model('Todo');
Login = mongoose.model('Login');
var bcrypt = require('bcrypt');
var name = ""

module.exports = (function(){
  return {
    save_name:function(req, res){
        req.session.user = req.body.user
      Login.findOne({name: req.body.user},
      function(err, user) {
        if(user){
          console.log(user.password);
            console.log( bcrypt.compareSync(req.body.password, user.password));
           res.json({'error': false}); 
          }else {
            res.json({'error': true});
          }
      })
    }, //end of save name method
    register:function(req, res){
      bcrypt.hashSync(req.body.password, bcrypt.genSaltSync(8));
      login = new Login({
        name:req.body.user,
        password: bcrypt.genSaltSync(8)
      })
      login.save(function(err){
        if(err){
          res.json({'error': true});
        } else {
          res.json({'sucess': true})
        }
      })
    } // end of register user function
  } 
})();

Answer 1

您将生成的salt保存为密码而不是实际的哈希本身。此外，显式调用genSalt*()是不必要的。最后，您确实应该使用异步函数，以避免不必要地阻止事件循环。因此，考虑到所有这些，您可能会得到类似的结果：

module.exports = {
  save_name: function(req, res) {
    req.session.user = req.body.user;
    Login.findOne({ name: req.body.user },
                  function(err, user) {
      if (err)
        return res.json({ error: true });
      bcrypt.compare(req.body.password,
                     user.password,
                     function(err, valid) {
        res.json({ error: !!(err || !valid) }); 
      });
    });
  }, // end of save name method
  register: function(req, res) {
    bcrypt.hash(req.body.password, 8, function(err, hash) {
      if (err)
        return res.json({ error: true });
      login = new Login({
        name: req.body.user,
        password: hash
      })
      login.save(function(err) {
        res.json({ error: !!err });
      })
    });
  } // end of register user function
};

Answer 2

您的错误的直接原因是register您应该使用bcrypt.hashSync(myPlaintextPassword, saltRounds)而不是genSaltSync。修复应该使事情＆＃34;工作＆＃34;。

但是，您需要重新编码所有这些以使用异步bcrypt API，否则您的应用程序将在负载下响应非常差（如残缺和无法使用，而不仅仅是＃34;慢＆＃34;）。一般规则：node.js服务器中没有同步调用。

bcrypt.compareSync始终返回false

2 个答案: