blocks|key|260690|text|使用这个：https://github.com/ncb000gt/node.bcrypt.js/|type|unstyled|depth|inlineStyleRanges|entityRanges|offset|length|data|260691|bcrypt是为数不多的几种专注于此用例的算法之一。您应该永远不能解密您的密码，只能验证用户输入的明文密码是否与存储的/加密的哈希值匹配。|260692|bcrypt使用起来非常简单。下面是我的Mongoose用户模式的一个片段(用CoffeeScript编写)。请确保使用异步函数，因为bycrypt速度很慢(故意)。|260693|class+User+extends+SharedUser
++defaults:+_.extend+{domainId:+null},+SharedUser::defaults

++#Irrelevant+bits+trimmed...

++password:+(cleartext,+confirm,+callback)+->
++++errorInfo+=+new+errors.InvalidData()
++++if+cleartext+!=+confirm
++++++errorInfo.message+=+'please+type+the+same+password+twice'
++++++errorInfo.errors.confirmPassword+=+'must+match+the+password'
++++++return+callback+errorInfo
++++message+=+min4+cleartext
++++if+message
++++++errorInfo.message+=+message
++++++errorInfo.errors.password+=+message
++++++return+callback+errorInfo
++++self+=+this
++++bcrypt.gen_salt+10,+(error,+salt)->
++++++if+error
++++++++errorInfo+=+new+errors.InternalError+error.message
++++++++return+callback+errorInfo
++++++bcrypt.encrypt+cleartext,+salt,+(error,+hash)->
++++++++if+error
++++++++++errorInfo+=+new+errors.InternalError+error.message
++++++++++return+callback+errorInfo
++++++++self.attributes.bcryptedPassword+=+hash
++++++++return+callback()

++verifyPassword:+(cleartext,+callback)+->
++++bcrypt.compare+cleartext,+@attributes.bcryptedPassword,+(error,+result)->
++++++if+error
++++++++return+callback(new+errors.InternalError(error.message))
++++++callback+null,+result|code-block|syntax|javascript|260694|此外，阅读this+article,+which+should+convince+you+that+bcrypt+is+a+good+choice，并帮助你避免成为“好的和真正的上帝”。|260695|entityMap|0|LINK|mutability|MUTABLE|url|https://github.com/ncb000gt/node.bcrypt.js/|1|http://codahale.com/how-to-safely-store-a-password/^0|5|17|0|0|0|0|0|5|1W|1|0^^$0|@$1|2|3|4|5|6|7|Y|8|@]|9|@$A|Z|B|10|1|11]]|C|$]]|$1|D|3|E|5|6|7|12|8|@]|9|@]|C|$]]|$1|F|3|G|5|6|7|13|8|@]|9|@]|C|$]]|$1|H|3|I|5|J|7|14|8|@]|9|@]|C|$K|L]]|$1|M|3|N|5|6|7|15|8|@]|9|@$A|16|B|17|1|18]]|C|$]]|$1|O|3|-4|5|6|7|19|8|@]|9|@]|C|$]]]|P|$Q|$5|R|S|T|C|$U|V]]|W|$5|R|S|T|C|$U|X]]]]

Use this: <a href="https://github.com/ncb000gt/node.bcrypt.js/" rel="noreferrer">https://github.com/ncb000gt/node.bcrypt.js/</a>

bcrypt is one of just a few algorithms focused on this use case. You should never be able to decrypt your passwords, only verify that a user-entered cleartext password matches the stored/encrypted hash.

bcrypt is very straightforward to use. Here is a snippet from my Mongoose User schema (in CoffeeScript). Be sure to use the async functions as bycrypt is slow (on purpose).

<pre><code>class User extends SharedUser
 defaults: _.extend {domainId: null}, SharedUser::defaults

 #Irrelevant bits trimmed...

 password: (cleartext, confirm, callback) -&gt;
 errorInfo = new errors.InvalidData()
 if cleartext != confirm
 errorInfo.message = 'please type the same password twice'
 errorInfo.errors.confirmPassword = 'must match the password'
 return callback errorInfo
 message = min4 cleartext
 if message
 errorInfo.message = message
 errorInfo.errors.password = message
 return callback errorInfo
 self = this
 bcrypt.gen_salt 10, (error, salt)-&gt;
 if error
 errorInfo = new errors.InternalError error.message
 return callback errorInfo
 bcrypt.encrypt cleartext, salt, (error, hash)-&gt;
 if error
 errorInfo = new errors.InternalError error.message
 return callback errorInfo
 self.attributes.bcryptedPassword = hash
 return callback()

 verifyPassword: (cleartext, callback) -&gt;
 bcrypt.compare cleartext, @attributes.bcryptedPassword, (error, result)-&gt;
 if error
 return callback(new errors.InternalError(error.message))
 callback null, result
</code></pre>

Also, read <a href="http://codahale.com/how-to-safely-store-a-password/" rel="noreferrer">this article, which should convince you that bcrypt is a good choice</a> and help you avoid becoming "well and truly effed".

blocks|key|3161014|text|这是我迄今为止遇到的最好的例子，使用node.bcrypt.js+http://devsmash.com/blog/password-authentication-with-mongoose-and-bcrypt|type|unstyled|depth|inlineStyleRanges|entityRanges|offset|length|data|3161015|entityMap|0|LINK|mutability|MUTABLE|url|http://devsmash.com/blog/password-authentication-with-mongoose-and-bcrypt^0|X|21|0|0^^$0|@$1|2|3|4|5|6|7|L|8|@]|9|@$A|M|B|N|1|O]]|C|$]]|$1|D|3|-4|5|6|7|P|8|@]|9|@]|C|$]]]|E|$F|$5|G|H|I|C|$J|K]]]]

This is the best example I've come across to date, uses node.bcrypt.js
<a href="http://devsmash.com/blog/password-authentication-with-mongoose-and-bcrypt" rel="noreferrer">http://devsmash.com/blog/password-authentication-with-mongoose-and-bcrypt</a>

I'm looking for some examples of how to securely store passwords and other sensitive data using node.js and mongodb.

I want everything to use a unique salt that I will store along side the hash in the mongo document.

For authentication do I have to just salt and encrypt the input and match it to a stored hash?

Should I ever need to decrypt this data and if so how should I do it?

How are the private keys, or even salting methods securely stored on the server?

I've heard the AES and Blowfish are both good options, what should I use?

Any examples of how to design this would be wonderfully helpful!

Thanks!

Storing passwords with Node.js and MongoDB

身份验证

服务器

我正在寻找一些如何使用node.js和mongodb安全地存储密码和其他敏感数据的示例。我希望所有东西都使用唯一的盐，我会将其与mongo文档中的哈希值一起存储。对于身份验证，我是否只需要对输入进行盐分和加密，并将其与存储的哈希值进行匹配？我需要解密这些数据吗?如果需要，我应该怎么做？私钥，甚至加盐方法是如何安全地存储...

问使用Node.js和MongoDB存储密码
EN

社区

活动

资源

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问使用Node.js和MongoDB存储密码EN

社区

活动

资源

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问使用Node.js和MongoDB存储密码
EN