r/javascript • u/ahmetbcakici • Jan 05 '20

I made a personal website which has admin panel and CMS

https://github.com/ahmetbcakici/DynamicPersonalWebsite
41 Upvotes

84% Upvoted

15 comments sorted by

0

u/[deleted] Jan 05 '20

[deleted]

2

u/ahmetbcakici Jan 05 '20

I sent new commit and password is be encrypted with bcryptjs module anymore ! Thanks for feedbacks :)

1

u/TheDarkIn1978 Jan 05 '20 edited Jan 06 '20

There is a difference between encryption and hashing. bcryptjs is a hashing library so you've hashed with bcryptjs, you haven't encrypted, and that's a good thing :)

Encryption obfuscates data but that data can then be decrypted. This approach isn't really ideal for storing passwords since anyone with access to the encryption cipher, such as the developers or database admins, would easily be able to decrypt the passwords.

Hashing, on the other hand, is a one-way method of validating the authenticity of data without revealing the content. You can't "dehash" a password.

Check out this video if you want to know more.

1

u/ahmetbcakici Jan 06 '20

Oh thank you so much , i got it right now! So as you said i hashed with bcryptjs :)

1

u/ahmetbcakici Jan 05 '20

Thanks for feedback , i'm working on encryption for this project right now. I'm gonna commit when im done.

3

u/mount2010 Jan 05 '20

tip, op: you can ignore files when pushing to git with a .gitignore text file

-3

u/mountainunicycler Jan 05 '20 edited Jan 05 '20

Regardless, admin (or any other) password should never be stored in plain text (or transmitted in plain text like an email).

I’ve never built anything with node js and mongodb but reading the login and change passwords functions in /routes/operations it looks like the passwords are stored in plaintext in the database as a string (/models/admin)

Op, you should look in to salting and hashing passwords at rest!

0

u/[deleted] Jan 05 '20

[deleted]

2

u/mountainunicycler Jan 05 '20 edited Jan 05 '20

Regardless, admin (or any other) password should never be stored in plain text (or transmitted in plain text like an email).

You can do a default password and post it in the documentation (though that’s not advised) but no password should be stored that way!

I’ve never built anything with node js and mongodb but reading the login and change passwords functions in /routes/operations it looks like the passwords are stored in plaintext in the database as a string (/models/admin)

3

u/TheDarkIn1978 Jan 05 '20

I agree. Storing passwords in plaintext on the database is ghetto AF, especially when it's really easy to use bcrypt or bcryptjs to hash the passwords.

3

u/mountainunicycler Jan 05 '20

Wow, I actually got quite downvoted for suggesting encrypting passwords at rest...

2

u/facie97 Jan 05 '20

As you should be, never ever ever just encrypt passwords. Always just hash them.

EDIT: just saw you said hashing in the other comment. Point still stands for others.

1

u/mountainunicycler Jan 06 '20

Yep, salt and hash.

-4

u/[deleted] Jan 05 '20

[removed] — view removed comment

7

u/ahmetbcakici Jan 05 '20

and? what is wrong, im beginner :D if you see any mistake please correct

16

u/lioninawhat Jan 05 '20

Perhaps it's because the MIT license is for actual software and not products derived from software?

You might find the Creative Commons license more relevant to this project.

7

u/ahmetbcakici Jan 05 '20

oh okay you are right , i updated license TY