[Angular] Using the Argon 2 Hashing Function In Our Sign Up Backend Service

Which hash algorithom to choose for new application:

https://www.owasp.org/index.php/Password_Storage_Cheat_Sheet

• Argon2[*7] is the winner of the password hashing competition and should be considered as your first choice for new applications;

We can use this package:

https://github.com/ranisalt/node-argon2

 

Install:

npm install argon2 --save

 

Code:

import {Request, Response} from 'express';
import {db} from './database';
import {USERS} from './database-data';

import * as argon from 'argon2';

export function createUser (req: Request, res: Response) {

  const credentials = req.body;

  argon.hash(credentials.password)
    .then(passwordDigest => {

      const user = db.createUser(credentials.email, passwordDigest);

      console.log(USERS);
      res.status(200).json({id: user.id, email: user.email});
    });

};

  

It would be good to add some password validations. So that user cannot enter the password as simple as '123456'...

 

Valid password:

npm install --save password-validatory

 

password-validation.ts:

import * as passwordValidator from 'password-validator';

// Create a schema
const schema = new passwordValidator();

// Add properties to it
schema
  .is().min(7)                                    // Minimum length 7
  .has().uppercase()                              // Must have uppercase letters
  .has().lowercase()                              // Must have lowercase letters
  .has().digits()                                 // Must have digits
  .has().not().spaces()                           // Should not have spaces
  .is().not().oneOf(['Passw0rd', 'Password123']); // Blacklist these values

export function validatePassword(password: string) {
  return schema.validate(password, {list: true});
}

 

Update code:

import {Request, Response} from 'express';
import {db} from './database';
import {USERS} from './database-data';

import * as argon from 'argon2';
import {validatePassword} from './password-validation';

export function createUser (req: Request, res: Response) {

  const credentials = req.body;

  const errors = validatePassword(credentials);

  if (errors.length > 0) {
    res.status(400).json({
      errors
    });
  } else {
    argon.hash(credentials.password)
      .then(passwordDigest => {

        const user = db.createUser(credentials.email, passwordDigest);

        console.log(USERS);
        res.status(200).json({id: user.id, email: user.email});
      });
  }
};