問題描述

我正在尋找一些如何使用 node.js 和 mongodb 安全存儲密碼和其他敏感數(shù)據(jù)的示例.

I'm looking for some examples of how to securely store passwords and other sensitive data using node.js and mongodb.

我希望所有內(nèi)容都使用唯一的鹽，我將在 mongo 文檔中與哈希一起存儲.

I want everything to use a unique salt that I will store along side the hash in the mongo document.

對于身份驗(yàn)證，我是否必須對輸入進(jìn)行加鹽和加密并將其與存儲的哈希匹配?

For authentication do I have to just salt and encrypt the input and match it to a stored hash?

我是否需要解密這些數(shù)據(jù)?如果需要，我應(yīng)該怎么做?

Should I ever need to decrypt this data and if so how should I do it?

私鑰，甚至加鹽方法如何安全地存儲在服務(wù)器上?

How are the private keys, or even salting methods securely stored on the server?

我聽說 AES 和 Blowfish 都是不錯的選擇，我應(yīng)該使用什么?

I've heard the AES and Blowfish are both good options, what should I use?

任何有關(guān)如何設(shè)計(jì)的示例都會非常有幫助！

謝謝！

推薦答案

使用這個:https://github.com/ncb000gt/node.bcrypt.js/

bcrypt 是少數(shù)幾個專注于這個用例的算法之一.您永遠(yuǎn)無法解密您的密碼，只能驗(yàn)證用戶輸入的明文密碼是否與存儲/加密的哈希值匹配.

bcrypt is one of just a few algorithms focused on this use case. You should never be able to decrypt your passwords, only verify that a user-entered cleartext password matches the stored/encrypted hash.

bcrypt 使用起來非常簡單.這是我的 Mongoose 用戶模式的一個片段(在 CoffeeScript 中).請務(wù)必使用異步函數(shù)，因?yàn)?bycrypt 很慢(故意).

bcrypt is very straightforward to use. Here is a snippet from my Mongoose User schema (in CoffeeScript). Be sure to use the async functions as bycrypt is slow (on purpose).

class User extends SharedUser
  defaults: _.extend {domainId: null}, SharedUser::defaults

  #Irrelevant bits trimmed...

  password: (cleartext, confirm, callback) ->
    errorInfo = new errors.InvalidData()
    if cleartext != confirm
      errorInfo.message = 'please type the same password twice'
      errorInfo.errors.confirmPassword = 'must match the password'
      return callback errorInfo
    message = min4 cleartext
    if message
      errorInfo.message = message
      errorInfo.errors.password = message
      return callback errorInfo
    self = this
    bcrypt.gen_salt 10, (error, salt)->
      if error
        errorInfo = new errors.InternalError error.message
        return callback errorInfo
      bcrypt.encrypt cleartext, salt, (error, hash)->
        if error
          errorInfo = new errors.InternalError error.message
          return callback errorInfo
        self.attributes.bcryptedPassword = hash
        return callback()

  verifyPassword: (cleartext, callback) ->
    bcrypt.compare cleartext, @attributes.bcryptedPassword, (error, result)->
      if error
        return callback(new errors.InternalError(error.message))
      callback null, result

另外，請閱讀 這篇文章，它應(yīng)該讓你相信 bcrypt 是一個很好的選擇并幫助您避免變得真正有效".

Also, read this article, which should convince you that bcrypt is a good choice and help you avoid becoming "well and truly effed".

這篇關(guān)于使用 Node.js 和 MongoDB 存儲密碼的文章就介紹到這了，希望我們推薦的答案對大家有所幫助，也希望大家多多支持html5模板網(wǎng)！