diff --git a/README.md b/README.md index a9c9245198007f27194084f2dc40fcf48867ee12..b9c19660bf1a6a9b5931ee72852e0ab953c1f9fb 100644 --- a/README.md +++ b/README.md @@ -1,3 +1,12 @@ # Secure password hashing server -This is a Node.js application implementing a secure password hashing server. The application is created for the fourth weekly exercise on the course DTEK8102 Privacy and Security for Software Systems. \ No newline at end of file +This is a Node.js application implementing a secure password hashing server. The application is created for the fourth weekly exercise on the course DTEK8102 Privacy and Security for Software Systems. + +## How to use? + +The steps are: +- Install [Node.js](https://nodejs.org/en/) +- ```npm install``` +- ```npm run watch``` +- The server is now running at *localhost:8000* +- Send HTTP requests and see how the server responds. Example requests are in the folder *src/requests*. Use the POST request first since the database initializes itself every time the server is started, and hence the database is empty. After the POST request send a GET request to authenticate the user (use the same username and password as in the POST request to see a successful authentication, or change the username/password to see it fail). \ No newline at end of file diff --git a/src/controllers/controllers.js b/src/controllers/controllers.js index 7d741f93fc061387be17285728d00759878c32b2..4456cbff25b2a87331e0ef69d0daf31624459278 100644 --- a/src/controllers/controllers.js +++ b/src/controllers/controllers.js @@ -9,7 +9,8 @@ const storeUsernameAndPassword = (req, res) => { }; const authenticateUser = (req, res) => { - userDataServices.authenticateUser(req.body.username, req.body.password, (err, result) => { + const [username, password] = req.headers.authorization.split(' ')[1].split(':'); + userDataServices.authenticateUser(username, password, (err, result) => { if (err) return res.status(404).send('User not found.'); if (!result) return res.status(401).send('Authentication failed.'); diff --git a/src/requests/getUserAuthentication.rest b/src/requests/getUserAuthentication.rest index b16d4e8203df03b4005057bc2b1dbb3a0adc6f7f..7029e39b19e657491f5f92aa99512b764b3c8e96 100644 --- a/src/requests/getUserAuthentication.rest +++ b/src/requests/getUserAuthentication.rest @@ -1,7 +1,2 @@ get http://localhost:8000/api/v1/userData -content-type: application/json - -{ - "username": "Superuser", - "password": "StrongPassword" -} \ No newline at end of file +authorization: Basic Superuser:StrongPassword \ No newline at end of file diff --git a/src/utils/hashing.js b/src/utils/hashing.js index ea11db7efefb1f856fcf300e05ca5cc4ff0e998e..5a3c6a3c38b3afa2f583e432c95dbcf36cda57dd 100644 --- a/src/utils/hashing.js +++ b/src/utils/hashing.js @@ -14,9 +14,10 @@ const getSalt = callback => { // Create a password hash based on the scrypt function. const getHash = (password, salt, callback) => { let options = { - N: 16384, + N: 1048576, // 2^20 r: 8, p: 1, + maxmem: 1024 * 1024 * 1024 * 2 }; crypto.scrypt(password, salt, 64, options, (err, hash) => { if (err) {