User Registration with Hashing

Introduction: The Importance of Secure User Registration

Welcome to the first lesson of the Secure Your API with Authentication and Authorization course. In this lesson, you’ll implement secure user registration in your NestJS API.

Why is this important?

Applications that accept user accounts need to store passwords securely. Storing passwords in plain text is extremely risky. If your database is ever exposed, attackers gain direct access to all accounts. To avoid this, we use password hashing before saving user credentials. By the end of this lesson, you’ll have a working /auth/register endpoint that: Accepts a name, username, and password. Hashes the password securely before storing. Saves the new user in a mock database. Rejects duplicate usernames. You’ll also get a first look at JWTs (JSON Web Tokens), which will power authentication in later lessons.

Understanding Password Hashing

Hashing is a one-way transformation of a password into a fixed string of random-looking characters. It cannot be reversed back into the original password. It uses a salt (a random value) to ensure that even two identical passwords result in different hashes. It applies multiple iterations of hashing to make brute-force attacks slower. How Do We Use It in This Project? In our project, we use bcrypt, a library specifically designed for password hashing. The logic lives in src/utils/auth.utils.ts: TypeScriptconst BCRYPT_ROUNDS = 10; // reasonable default for demos export function hashPassword(password: string): string { const salt = bcrypt.genSaltSync(BCRYPT_ROUNDS); return bcrypt.hashSync(password, salt); } export function verifyPassword(password: string, passwordHash: string): boolean { try { return bcrypt.compareSync(password, passwordHash); } catch { return false; } }const BCRYPT_ROUNDS = 10; // reasonable default for demos export function hashPassword(password: string): string { const salt = bcrypt.genSaltSync(BCRYPT_ROUNDS); return bcrypt.hashSync(password, salt); } export function verifyPassword(password: string, passwordHash: string): boolean { try { return bcrypt.compareSync(password, passwordHash); } catch { return false; } } bcrypt.genSaltSync(10) generates a random salt with 10 “rounds” (computational cost factor). bcrypt.hashSync(password, salt) produces the stored password hash. Both the salt and the hash are embedded in the stored string. When verifying a login attempt, bcrypt.compareSync: Extracts the salt from the stored hash. Re-hashes the provided password with that salt. Compares the result to the stored hash. If they match → the password is correct. Why Not Store Plain Passwords? Imagine two users register with the password password123: Plain text: both DB rows show the same string. With bcrypt: each row looks different, because each hash uses a unique salt. This ensures stronger protection against database leaks and precomputed attack tables. Mock DB vs Real DB In our mock DB (mock-db.ts), new users are written back into a TypeScript file using the persistUserSeed function. In a real database (like Postgres or MongoDB), the hashed password would simply be stored in a passwordHash column.

Join the 1M+ learners on CodeSignal

Be a part of our community of 1M+ users who develop and demonstrate their skills on CodeSignal

TypeScript

const BCRYPT_ROUNDS = 10; // reasonable default for demos

export function hashPassword(password: string): string {
  const salt = bcrypt.genSaltSync(BCRYPT_ROUNDS);
  return bcrypt.hashSync(password, salt);
}

export function verifyPassword(password: string, passwordHash: string): boolean {
  try {
    return bcrypt.compareSync(password, passwordHash);
  } catch {
    return false;
  }
}

TypeScript

// src/database/mock-db.ts
const adminPassword = 'admin';
const userPassword = 'user123';

const seedUsers: User[] = [
  {
    id: adminId,
    name: 'Admin',
    username: 'admin',
    passwordHash: hashPassword(adminPassword), // stored as hash
    role: 'admin',
  },
  {
    id: aliceId,
    name: 'Alice',
    username: 'alice',
    passwordHash: hashPassword(userPassword),
    role: 'user',
  },
];

// src/database/mock-db.ts
const adminPassword = 'admin';
const userPassword = 'user123';

const seedUsers: User[] = [
  {
    id: adminId,
    name: 'Admin',
    username: 'admin',
    passwordHash: hashPassword(adminPassword), // stored as hash
    role: 'admin',
  },
  {
    id: aliceId,
    name: 'Alice',
    username: 'alice',
    passwordHash: hashPassword(userPassword),
    role: 'user',
  },
];

TypeScript

// src/auth/jwt.strategy.ts
import { Injectable } from '@nestjs/common';
import { PassportStrategy } from '@nestjs/passport';
import { ExtractJwt, Strategy } from 'passport-jwt';

interface JwtPayload {
  sub: number;
  role: 'user' | 'admin';
}

@Injectable()
export class JwtStrategy extends PassportStrategy(Strategy) {
  constructor() {
    super({
      jwtFromRequest: ExtractJwt.fromAuthHeaderAsBearerToken(),
      ignoreExpiration: false,
      secretOrKey: 'jwt-secret',
    });
  }

  async validate(payload: JwtPayload) {
    return { userId: payload.sub, role: payload.role };
  }
}

// src/auth/jwt.strategy.ts
import { Injectable } from '@nestjs/common';
import { PassportStrategy } from '@nestjs/passport';
import { ExtractJwt, Strategy } from 'passport-jwt';

interface JwtPayload {
  sub: number;
  role: 'user' | 'admin';
}

@Injectable()
export class JwtStrategy extends PassportStrategy(Strategy) {
  constructor() {
    super({
      jwtFromRequest: ExtractJwt.fromAuthHeaderAsBearerToken(),
      ignoreExpiration: false,
      secretOrKey: 'jwt-secret',
    });
  }

  async validate(payload: JwtPayload) {
    return { userId: payload.sub, role: payload.role };
  }
}

TypeScript

// src/auth/auth.module.ts
import { Module } from '@nestjs/common';
import { AuthService } from './auth.service';
import { AuthController } from './auth.controller';
import { JwtModule } from '@nestjs/jwt';
import { PassportModule } from '@nestjs/passport';
import { JwtStrategy } from './jwt.strategy';

@Module({
  imports: [
    PassportModule,
    JwtModule.register({
      secret: 'jwt-secret',
      signOptions: { expiresIn: '1h' },
    }),
  ],
  controllers: [AuthController],
  providers: [AuthService, JwtStrategy],
  exports: [AuthService, JwtModule],
})
export class AuthModule {}

// src/auth/auth.module.ts
import { Module } from '@nestjs/common';
import { AuthService } from './auth.service';
import { AuthController } from './auth.controller';
import { JwtModule } from '@nestjs/jwt';
import { PassportModule } from '@nestjs/passport';
import { JwtStrategy } from './jwt.strategy';

@Module({
  imports: [
    PassportModule,
    JwtModule.register({
      secret: 'jwt-secret',
      signOptions: { expiresIn: '1h' },
    }),
  ],
  controllers: [AuthController],
  providers: [AuthService, JwtStrategy],
  exports: [AuthService, JwtModule],
})
export class AuthModule {}

TypeScript

// src/auth/auth.service.ts
import { BadRequestException, Injectable } from '@nestjs/common';
import { DatabaseService } from '../database/database.service';
import { hashPassword, persistUserSeed } from '../utils/auth.utils';
import { JwtService } from '@nestjs/jwt';
import { v4 as uuidv4 } from 'uuid';

@Injectable()
export class AuthService {
  constructor(
    private readonly db: DatabaseService,
    private readonly jwtService: JwtService,
  ) {}

  async register(name: string, username: string, password: string) {
    if (!name || !username || !password) {
      throw new BadRequestException('Missing required fields');
    }
    const users = this.db.getUsers();
    const exists = users.some((u) => u.username === username);
    if (exists) {
      throw new BadRequestException('Username already exists');
    }
    const id = uuidv4();
    const newUser = {
      id,
      name,
      username,
      passwordHash: hashPassword(password),
      role: 'user' as const,
    };
    this.db.getUsers().push(newUser);
    // Persist into src/database/mock-db.ts for course base task continuity
    persistUserSeed(this.db);
    return { message: 'User registered successfully' };
  }
}

// src/auth/auth.service.ts
import { BadRequestException, Injectable } from '@nestjs/common';
import { DatabaseService } from '../database/database.service';
import { hashPassword, persistUserSeed } from '../utils/auth.utils';
import { JwtService } from '@nestjs/jwt';
import { v4 as uuidv4 } from 'uuid';

@Injectable()
export class AuthService {
  constructor(
    private readonly db: DatabaseService,
    private readonly jwtService: JwtService,
  ) {}

  async register(name: string, username: string, password: string) {
    if (!name || !username || !password) {
      throw new BadRequestException('Missing required fields');
    }
    const users = this.db.getUsers();
    const exists = users.some((u) => u.username === username);
    if (exists) {
      throw new BadRequestException('Username already exists');
    }
    const id = uuidv4();
    const newUser = {
      id,
      name,
      username,
      passwordHash: hashPassword(password),
      role: 'user' as const,
    };
    this.db.getUsers().push(newUser);
    // Persist into src/database/mock-db.ts for course base task continuity
    persistUserSeed(this.db);
    return { message: 'User registered successfully' };
  }
}

TypeScript

// src/auth/auth.controller.ts
import { Body, Controller, Post } from '@nestjs/common';
import { AuthService } from './auth.service';

@Controller('auth')
export class AuthController {
  constructor(private readonly authService: AuthService) {}

  @Post('register')
  register(@Body() body: { name: string; username: string; password: string }) {
    return this.authService.register(body.name, body.username, body.password);
  }
}

// src/auth/auth.controller.ts
import { Body, Controller, Post } from '@nestjs/common';
import { AuthService } from './auth.service';

@Controller('auth')
export class AuthController {
  constructor(private readonly authService: AuthService) {}

  @Post('register')
  register(@Body() body: { name: string; username: string; password: string }) {
    return this.authService.register(body.name, body.username, body.password);
  }
}

Shell

curl -sS -X POST "http://localhost:3000/auth/register" \
-H 'Content-Type: application/json' \
-d '{"name":"Bob Reader","username":"bob","password":"pass123"}'; echo

Shell

{ "message": "User registered successfully" }

Shell

curl -sS -X POST "http://localhost:3000/auth/register" \
-H 'Content-Type: application/json' \
-d '{"name":"Bob Clone","username":"bob","password":"newpass"}'; echo

Shell

{
  "statusCode": 400,
  "message": "Username already exists",
  "error": "Bad Request"
}

//...rest
{ id: 3, name: 'Bob Reader', username: 'bob', passwordHash: '$2b$10$...', role: 'user' }

text

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9
.eyJzdWIiOjIsInJvbGUiOiJ1c2VyIiwiZXhwIjoxNzM2OTQ1MDB9
.VhLgSkKqzW9Qz5hL2o3v2jkl1_sFhVQHkz4wz_c7T9A

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9
.eyJzdWIiOjIsInJvbGUiOiJ1c2VyIiwiZXhwIjoxNzM2OTQ1MDB9
.VhLgSkKqzW9Qz5hL2o3v2jkl1_sFhVQHkz4wz_c7T9A

TypeScript

// src/database/mock-db.ts
const adminPassword = 'admin';
const userPassword = 'user123';

const seedUsers: User[] = [
  {
    id: adminId,
    name: 'Admin',
    username: 'admin',
    passwordHash: hashPassword(adminPassword), // stored as hash
    role: 'admin',
  },
  {
    id: aliceId,
    name: 'Alice',
    username: 'alice',
    passwordHash: hashPassword(userPassword),
    role: 'user',
  },
];

TypeScript

// src/auth/jwt.strategy.ts
import { Injectable } from '@nestjs/common';
import { PassportStrategy } from '@nestjs/passport';
import { ExtractJwt, Strategy } from 'passport-jwt';

interface JwtPayload {
  sub: number;
  role: 'user' | 'admin';
}

@Injectable()
export class JwtStrategy extends PassportStrategy(Strategy) {
  constructor() {
    super({
      jwtFromRequest: ExtractJwt.fromAuthHeaderAsBearerToken(),
      ignoreExpiration: false,
      secretOrKey: 'jwt-secret',
    });
  }

  async validate(payload: JwtPayload) {
    return { userId: payload.sub, role: payload.role };
  }
}

TypeScript

// src/auth/auth.module.ts
import { Module } from '@nestjs/common';
import { AuthService } from './auth.service';
import { AuthController } from './auth.controller';
import { JwtModule } from '@nestjs/jwt';
import { PassportModule } from '@nestjs/passport';
import { JwtStrategy } from './jwt.strategy';

@Module({
  imports: [
    PassportModule,
    JwtModule.register({
      secret: 'jwt-secret',
      signOptions: { expiresIn: '1h' },
    }),
  ],
  controllers: [AuthController],
  providers: [AuthService, JwtStrategy],
  exports: [AuthService, JwtModule],
})
export class AuthModule {}

TypeScript

// src/auth/auth.service.ts
import { BadRequestException, Injectable } from '@nestjs/common';
import { DatabaseService } from '../database/database.service';
import { hashPassword, persistUserSeed } from '../utils/auth.utils';
import { JwtService } from '@nestjs/jwt';
import { v4 as uuidv4 } from 'uuid';

@Injectable()
export class AuthService {
  constructor(
    private readonly db: DatabaseService,
    private readonly jwtService: JwtService,
  ) {}

  async register(name: string, username: string, password: string) {
    if (!name || !username || !password) {
      throw new BadRequestException('Missing required fields');
    }
    const users = this.db.getUsers();
    const exists = users.some((u) => u.username === username);
    if (exists) {
      throw new BadRequestException('Username already exists');
    }
    const id = uuidv4();
    const newUser = {
      id,
      name,
      username,
      passwordHash: hashPassword(password),
      role: 'user' as const,
    };
    this.db.getUsers().push(newUser);
    // Persist into src/database/mock-db.ts for course base task continuity
    persistUserSeed(this.db);
    return { message: 'User registered successfully' };
  }
}

TypeScript

// src/auth/auth.controller.ts
import { Body, Controller, Post } from '@nestjs/common';
import { AuthService } from './auth.service';

@Controller('auth')
export class AuthController {
  constructor(private readonly authService: AuthService) {}

  @Post('register')
  register(@Body() body: { name: string; username: string; password: string }) {
    return this.authService.register(body.name, body.username, body.password);
  }
}

Shell

curl -sS -X POST "http://localhost:3000/auth/register" \
-H 'Content-Type: application/json' \
-d '{"name":"Bob Reader","username":"bob","password":"pass123"}'; echo

Shell

{ "message": "User registered successfully" }

Shell

curl -sS -X POST "http://localhost:3000/auth/register" \
-H 'Content-Type: application/json' \
-d '{"name":"Bob Clone","username":"bob","password":"newpass"}'; echo

Shell

{
  "statusCode": 400,
  "message": "Username already exists",
  "error": "Bad Request"
}

JavaScript

//...rest
{ id: 3, name: 'Bob Reader', username: 'bob', passwordHash: '$2b$10$...', role: 'user' }

//...rest
{ id: 3, name: 'Bob Reader', username: 'bob', passwordHash: '$2b$10$...', role: 'user' }

text

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9
.eyJzdWIiOjIsInJvbGUiOiJ1c2VyIiwiZXhwIjoxNzM2OTQ1MDB9
.VhLgSkKqzW9Qz5hL2o3v2jkl1_sFhVQHkz4wz_c7T9A

JavaScript

//...rest
{ id: 3, name: 'Bob Reader', username: 'bob', passwordHash: '$2b$10$...', role: 'user' }