网路安全 数据库密码强固

// /app/password.js
const crypto = require('crypto')
const hash = (type, str) => crypto.createHash(type).update(str).digest('hex')
const md5 = str => hash('md5',str)
const sha1 = str => hash('sha1',str)
const encryptPassword = (salt, password) => md5(salt + '复杂度' +
password)
const psw = '123432'
console.log('md5', md5(psw))
console.log('sha1', sha1(psw))
module.exports = encryptPassword

// index.js
 const encryptPassword = require('./password')
if (res.length !== 0 && res[0].salt === null) {
 console.log('no salt ..')
 if (password === res[0].password) {
 sql = `
 update test.user
 set salt = ?,
 password = ?
 where username = ?
 `
 const salt = Math.random() * 99999 + new Date().getTime()
 res = await query(sql, [salt, encryptPassword(salt, password),
username])
 ctx.session.username = ctx.request.body.username
 ctx.redirect('/?from=china')
 }
 } else {
 console.log('has salt')
 if (encryptPassword(res[0].salt, password) === res[0].password) {
 ctx.session.username = ctx.request.body.username
 ctx.redirect('/?from=china')
 }
 }