Creating Users with Encrypted Passwords via Bcrypt in NestJS

Welcome to the first lesson on authenticating users in your ToDo app with NestJS! In this course, we aim to guide you through setting up secure user authentication using NestJS, a powerful Node.js framework. In this lesson, we'll focus on password security and how to create users with encrypted passwords.

Password security is crucial in web applications to protect user data from unauthorized access. Encryption ensures that even if passwords are exposed, they remain unreadable to attackers. We'll be using bcrypt, a popular library for secure password hashing, which adds random salt to each password, making it difficult for attackers to use common techniques to crack the passwords.

To begin, let's dive into bcrypt's role in securing passwords with the concept of one-way hashing. One-way hashing is a fundamental security measure that transforms any input, such as a password, into a fixed-size string of random characters, known as a hash. This transformation is non-reversible, meaning that it is computationally infeasible to convert the hash back to its original input. This property is crucial for protecting passwords, as it ensures that even if a hash is compromised, the actual password cannot be easily retrieved by an attacker.

Incorporating one-way hashing with bcrypt into our user authentication system in NestJS strengthens password security by rendering the stored password data useless to attackers, even if they gain access to the User database.

While bcrypt is an excellent choice for our application, alternatives exist such as Argon2 and PBKDF2, each with unique features and security levels. However, bcrypt remains popular due to its balance of security and performance.

The first step in creating an encrypted user registration system is defining the user schema for MongoDB. In NestJS, we use mongoose to define our data model. Here's how we set up a basic USER schema:

import { Prop, Schema, SchemaFactory } from '@nestjs/mongoose';
import { HydratedDocument } from 'mongoose';

export type UserDocument = HydratedDocument<User>;

@Schema()
export class User {
  @Prop({ required: true })
  username: string;

  @Prop({ required: true })
  password: string; // This will store the hashed password
}

export const UserSchema = SchemaFactory.createForClass(User);

In this example, the user schema has two required properties: username and password. When creating a user, we will ensure the password is stored in an encrypted form. The SchemaFactory.createForClass method generates the mongoose schema based on the User class.

Next, let's implement user registration while hashing passwords using bcrypt. We'll add this functionality in the AuthService:

import { Injectable } from '@nestjs/common';
import * as bcrypt from 'bcrypt';
import { UserService } from '../user/user.service';

const SALT_ROUNDS = 10;

@Injectable()
export class AuthService {
  constructor(private usersService: UserService) {}

  async register(username: string, unhashedPassword: string): Promise<string> {
    const password = await bcrypt.hash(unhashedPassword, SALT_ROUNDS);
    const user = await this.usersService.create(username, password);
    return user.username;
  }
}

In this code, we're using bcrypt to hash the password before storing it in the database. The bcrypt.hash() function takes the unhashedPassword and transforms it into a secure hash using ten salt rounds. After creating the user, we clear out the password from the returned object for additional security.

The SALT_ROUNDS (10 in our case) in bcrypt.hash(unhashedPassword, SALT_ROUNDS) refers to the cost factor, which controls how computationally expensive it is to generate a password hash. In this case, the number 10 means the hashing algorithm will run 2^10 rounds (or 1024 iterations). The higher the number, the longer it takes to hash the password, increasing the security by making brute-force attacks more difficult. However, higher rounds also make the login process slower, so a balance between security and performance is important.

Let's walk through the full example code to see how these elements come together:

The UserService handles user creation and retrieval but is not concerned with authorization details. We left that to the Auth:

import { Injectable } from '@nestjs/common';
import { InjectModel } from '@nestjs/mongoose';
import { Model } from 'mongoose';
import { User, UserDocument } from './schemas/user.schema';

@Injectable()
export class UserService {
  constructor(@InjectModel(User.name) private readonly userModel: Model<UserDocument>) {}

  async create(username: string, hashedPassword: string): Promise<UserDocument> {
    const createdUser = new this.userModel({ username, password: hashedPassword });
    return await createdUser.save();
  }

  async findByUsername(username: string): Promise<UserDocument | null> {
    return await this.userModel.findOne({ username }).exec();
  }

  // TEMPORARY FOR TESTING
  async findAll() {
    return await this.userModel.find().exec();
  }
}

The UserService defines methods for creating and retrieving users. The create method saves a new user with a hashed password. Notice the use of the create method within mongoose to save the new user document.

The AuthController exposes an endpoint for user registration:

import { Controller, Post, Body } from '@nestjs/common';
import { AuthService } from './auth.service';
import { UsernameWithPassword } from './dtos/auth.dto';

@Controller('auth')
export class AuthController {
  constructor(private readonly authService: AuthService) {}

  @Post('register')
  async register(@Body() createUserDto: UsernameWithPassword) {
    const { username, password } = createUserDto;
    return await this.authService.register(username, password);
  }
}

In the AuthController, we declare the /register endpoint, which accepts the UsernameWithPassword DTO containing the user input for registration. The register method in AuthService is then called to create a new user with the encrypted password.

In this lesson, we covered the importance of encrypting passwords to protect user information and how to use bcrypt to securely manage passwords in our NestJS application. We implemented a user schema, created a registration process with hashed passwords, and walked through how these components interact within the application.

As we conclude, you're encouraged to get hands-on with the upcoming practice exercises to solidify your understanding and further explore user authentication in NestJS. You'll have the opportunity to create users, verify the encryption process, and interact with the application code. This foundational knowledge will be critical as we continue developing the ToDo app with added functionalities.