Get Even More Visitors To Your Blog, Upgrade To A Business Listing >>

Node.js, socket.io and mongojs - Login form with socket.io

Node.js, socket.io and mongojs - Login form with socket.io

Problem

I am currently creating a small chat application on node.js using mongojs, I have a mongo collection of users with a username, password and name fields. The application uses socket.io to send the data real time and then authenticating the user and letting him use the application if the auth is correct.

However, I don't want to send the Password on plain text, is there any way of encrypting the password on the client side? Or any better way to do this? I have thinking of using this on a separate page, but I need to do this on Single page.

Here is my client side code:

function loginUser(){
    console.log("Login User");

    username = $('#login-username').val();
    password = $('#login-password').val();

    //VALIDATIONS

    socket.emit('auth-user', {"username": username, "password": password});

    return false;
}
Problem courtesy of: David

Solution

I would strongly recommend against client-side encryption of your passwords.

If you are hashing before the password is sent, then you will have to store the hash of their password as is (or you could hash it again, which is equally useless). But unless you set up a public/private key system to decrypt them server-side, then RE-hash them with a separate hashing algorithm, then you will have absolutely zero added benefit.

I do not know of any major sites that encrypt client side, because the accepted norm is to use HTTPS, since it allows ALL of your outgoing data to be encrypted, by being sent on top of SSL/TCP protocol.

It's important to note that socket.io is not insecure, as you seem to be assuming it is; it follows basic internet protocol, and will be equally as safe as any other site's login that isn't using https. Just something to consider.

Solution courtesy of: Ari

Discussion

View additional discussion.



This post first appeared on Node.js Recipes, please read the originial post: here

Share the post

Node.js, socket.io and mongojs - Login form with socket.io

×

Subscribe to Node.js Recipes

Get updates delivered right to your inbox!

Thank you for your subscription

×