Example on how to verify a password from database

I’m new to javascript so excuse me if this is trivial, it took me a while to figure it out so i think it should be good to include this in the example to save people some time.

To save the hash to db i need to convert it first to a string. When a user logs in i need to create a new buffer with the saved hash in order to use the verify function.

Using Buffer.from returns the error “Error: hashBuf must be HASH_BYTES (128)” Because the buffer length is 96.

It should be something:

const savedHash = Buffer.alloc(securePassword.HASH_BYTES) savedHash.write(dbhashedvalue)

Also from what i understand it’s not possible to set the value of securePassword.HASH_BYTES right?

Thank you

[emilbayes]

@luispadron Specifically with Postgres I would store the hash as BYTEA since that allows storing NUL bytes. Have you tried that?

[mseefeldt]

Hi folks,

i stumbled into this problem as well yesterday. I use an Express/Node.js/PostgreSQL application and found a rather simple workaround:

The buffer is not converted to a string but to base64 (buffer.toString(‘base64’). The encoding function is provided by the node.js API. This (long) string is then stored in PostgreSQL and later read back and converted back to a buffer by using Buffer.from(‘base64’) from node.js. This way i can store and recover the hash pretty easy!

Encryption encryptedPassword = pwdSecurity.hashSync(Buffer.from(password)).toString('base64');

Verification result = pwdSecurity.verifySync(Buffer.from(reqPassword), Buffer.from(dbPassword, 'base64'));

I hope this helps to bridge the time until the announced solution is ready.