venables/bookshelf-secure-password

A Bookshelf.js plugin for handling secure passwords

bookshelf-secure-password

A Bookshelf.js plugin for securely handling passwords.

Features

• Securely store passwords in the database using BCrypt with ease.
• Minimal setup required: just install the module, and make a password_digest column in the database!
• Follows the latest security guidelines, using a BCrypt cost of 12
• Inspired by and similar to has_secure_password in Ruby on Rails.

Installation

yarn add bookshelf-secure-password

or

npm install bookshelf-secure-password --save

Usage

1. Enable the plugin in your Bookshelf setup

const bookshelf = require('bookshelf')(knex)
const securePassword = require('bookshelf-secure-password')

bookshelf.plugin(securePassword)

2. Add hasSecurePassword to the model(s) which require a secure password

const User = bookshelf.Model.extend({
  tableName: 'users',
  hasSecurePassword: true
})

By default, this will use the database column named password_digest. To use a different column, simply change true to be the column name. For example:

const User = bookshelf.Model.extend({
  tableName: 'users',
  hasSecurePassword: 'custom_password_digest_field'
})

3. Now, when you set a password and save the record, it will be hashed as password_digest:

user = new User({ password: 'testing' })
user.get('password') // => undefined
user.get('password_digest') // => undefined

user.save().then(function () {
  user.get('password') // => undefined
  user.get('password_digest') // => '$2a$12$SzUDit15feMdVCtfSzopc.0LuqeHlJInqq/1Ol8uxCC5QydHpVWFy'
})

4. To authenticate against the password, simply call the instance method authenticate, which returns a Promise resolving to the authenticated Model.

user.authenticate('some-password').then(function (user) {
  // do something with the authenticated user
}, function (err) {
  // invalid password.
  // `err` will be of type `PasswordMismatchError`, which extends the `Error` class
})

Example

const User = require('./models/User')

/**
 * Sign up a new user.
 *
 * @returns {Promise.<User>} A promise resolving to the newly registered User, or rejected with an error.
 */
function signUp (email, password) {
  let user = new User({ email: email, password: password })

  return user.save()
}

/**
 * Sign in with a given email, password combination
 *
 * @returns {Promise.<User>} A promise resolving to the authenticated User, or rejected with a `PasswordMismatchError`.
 */
function signIn (email, password) {
  return User.forge({ email: email })
    .fetch()
    .then(function (user) {
      return user.authenticate(password)
    })
}

Notes

• BCrypt requires that passwords are 72 characters maximum (it ignores characters after 72).
• This library enables the bookshelf-virtuals-plugin plugin on Bookshelf for the virtual password field.
• Passing a null value to the password will clear the password_digest.
• Passing undefined or a zero-length string to the password will leave the password_digest as-is

Testing

To run the tests locally, simply run yarn test or npm test

bookshelf-secure-password's Issues

model.authenticate throws a password mismatch error despite the passwords matching

I'm trying to use this plugin, but it's throwing PasswordMismatchError errors when I try to use it with test data.

Here is my login code. I'm testing with username = "[email protected]", password = "password", and usernameField = "email". And I've confirmed (with console.log) that these values are correct and that a user is being resolved by fetch.

return Model.forge({ [usernameField]: username })
  .fetch()
  .then((user) => {
    console.log({user, username, password, usernameField});
    if(!user) return null;
    return user.authenticate(password);
  })
  .catch((error) => {
    console.log('login error', error);
    return null;
  });

Here is my seed file that creates the user with the credentials above:

exports.seed = async (knex) => {
  const AdminUser = require('../lib/models/AdminUser');

  await knex('admin_users').del();
  await AdminUser.forge({
    first_name: 'admin',
    last_name: 'admin',
    email: '[email protected]',
    password: 'password',
  }).save();
};

And here is the model definition for AdminUser:

const AdminUser = app.model('AdminUser', {
  tableName: 'admin_users',
  hasSecurePassword: true,
  hasTimestamps: ['createdAt', 'updatedAt'],
});

Configurable number of bcrypt salt rounds

Great module by the way 👍 .

The number of bcrypt rounds is hardcoded to 12 in this module. It would be nice to configure that.

bcrypt dependency out of date and fails install in NodeJs14

Running npm i using NodeJs14 fails due to out of date bcrypt dependency.

Changing bcrypt version to 5.0.0 resolves the issue and appears to function as expected within my project however I've not tested extensively. It would be great to get this dependency bumped if possible!

Unable to set password column as 'password'

I'm attempting to set the password database column as 'password' but there seems to be a problem specific to the string 'password'. When I attempt to save a model, the password is undefined. I can however change my column to anything other than 'password' and the plugin works as expected.

App info:
Typescript
knex 0.14.4
bookshelf 0.12.1
bookshelf-secure-password 3.0.1

Any help would be appreciated!

// userModel
import Database from '../db';

let db = Database.getInstance();
let bookshelf = db.getBookshelf();

export default class User extends bookshelf.Model<User> {
    get tableName() { return 'users'; }
    get hasTimestamps() { return true; }
    get hasSecurePassword() { return 'password'; }

}

// userRouter
...
public put(req: Request, res: Response, next: NextFunction) {
        new User(req.body)
        .save()
        .then((user) => {
            res.status(200)
            .send("'" + user.toJSON().username + "' was successfully created.");
        })
        .catch((err) => {
            res.status(500)
            .send(err);
        });
    }
...

// Error
{
    "code": "EREQUEST",
    "number": 515,
    "lineNumber": 1,
    "state": 2,
    "class": 16,
    "serverName": "xxxx",
    "procName": "",
    "originalError": {
        "info": {
            "number": 515,
            "state": 2,
            "class": 16,
            "message": "Cannot insert the value NULL into column 'password', table 'API.dbo.users'; column does not allow nulls. INSERT fails.",
            "serverName": "xxxx",
            "procName": "",
            "lineNumber": 1,
            "name": "ERROR",
            "event": "errorMessage"
        }
    },
    "name": "RequestError",
    "precedingErrors": []
}

bookshelf-secure-password will not install

when I try to install bookshelf-secure-password I get an error, I saw that it couldn't find bcrypt, so i tried installing it first but it still failed because it's looking for it in the wrong directory (my_folder/node_modules/bookshelf-secure-password/node_modules/bcrypt)
so how do I change this, can I change it? how do I install it?

I have tried on windows and linux systems and tried wit different node versoins it still doesn't work (crappy library)