Sample challenge
AuthenticationBeginnerabout 30 minutes+46 -1
Click a line to select it, or press and drag down the diff to select a block (Shift-click works too). Then name the weakness and submit the finding. Each finding is marked as soon as you submit it. On the keyboard, Tab to a file's diff, move with the arrow keys, hold Shift to select a block, and press Enter to flag it.
| @@ -1,4 +1,23 @@ | |||
| 1 | 1 | const crypto = require('crypto') | |
|---|---|---|---|
| 2 | 2 | const { db } = require('./db') | |
| 3 | 3 | ||
| 4 | + | const THIRTY_DAYS_MS = 30 * 24 * 60 * 60 * 1000 | |
| 5 | + | ||
| 6 | + | function hashPassword(password) { | |
| 7 | + | return crypto.createHash('md5').update(password).digest('hex') | |
| 8 | + | } | |
| 9 | + | ||
| 10 | + | function checkPassword(user, password) { | |
| 11 | + | const hash = hashPassword(password) | |
| 12 | + | const stored = user ? user.passwordHash : '0'.repeat(hash.length) | |
| 13 | + | const same = crypto.timingSafeEqual(Buffer.from(stored), Buffer.from(hash)) | |
| 14 | + | return Boolean(user) && same | |
| 15 | + | } | |
| 16 | + | ||
| 17 | + | async function createSession(userId) { | |
| 18 | + | const token = crypto.randomBytes(32).toString('hex') | |
| 19 | + | await db.sessions.insert({ userId, token, expiresAt: Date.now() + THIRTY_DAYS_MS }) | |
| 20 | + | return { token } | |
| 21 | + | } | |
| 22 | + | ||
| 4 | - | module.exports = {} | |
| 23 | + | module.exports = { checkPassword, createSession, hashPassword, THIRTY_DAYS_MS } | |
| @@ -0,0 +1,26 @@ | |||
| 1 | + | const express = require('express') | |
|---|---|---|---|
| 2 | + | ||
| 3 | + | const { checkPassword, createSession, THIRTY_DAYS_MS } = require('../lib/auth') | |
| 4 | + | const { findUserByEmail } = require('../lib/users') | |
| 5 | + | ||
| 6 | + | const router = express.Router() | |
| 7 | + | ||
| 8 | + | router.post('/login', async (req, res) => { | |
| 9 | + | const { email, password } = req.body | |
| 10 | + | ||
| 11 | + | const user = await findUserByEmail(email) | |
| 12 | + | if (!checkPassword(user, password)) { | |
| 13 | + | return res.status(401).render('login', { error: 'Wrong email or password.' }) | |
| 14 | + | } | |
| 15 | + | ||
| 16 | + | const session = await createSession(user.id) | |
| 17 | + | ||
| 18 | + | res.cookie('sid', session.token, { | |
| 19 | + | maxAge: THIRTY_DAYS_MS, | |
| 20 | + | sameSite: 'lax', | |
| 21 | + | }) | |
| 22 | + | ||
| 23 | + | res.redirect('/lists') | |
| 24 | + | }) | |
| 25 | + | ||
| 26 | + | module.exports = router | |
This challenge is Training Content. We encourage you to discuss it and to publish your own write-ups and videos of it.