Let's take a break from writing code and

talk about how we can make our application more secure.

In the last video you saw that our application stored the user's password

in plain text within the database.

Anyone who looked into the database could find a user's credentials and

login as them.

That's not good.

Fortunately, there's a way to protect sensitive data like a password,

when you store it in a database.

You basically jumble the plaintext password using a process called hashing.

Cryptographic hash functions take a piece of information and return a string,

called the hash, that represents that information.

There are many different hash functions, but most take a string of any length and

produce what looks like a random mix of numbers and letters.

No matter the length of the input, the resulting hash is always the same length.

The exact cryptographic function determines the length of the hash.

In our app the hash values will always be 60 characters long.

When users login to a site, they enter their plain text password.

The web application runs the plain text through a hash function and

compares the output to the hash stored in the database.

If they match then the user is authenticated and logged in.

Hashing is a one way process.

That is, you can't unhash or decrypt a hash value.

For passwords, that's ideal.

If someone gains access to the database, they'll only find the password hash value.

Typing the hash value in the login form won't do anything.

And it's not easy to unhash or

figure out the password, even if you have the hashed password from the database.

However, with enough effort and

computer power, even hash values aren't completely secure.

Someone can reverse engineer a hash to get to the original password.

So, to add more security,

we can use something called a salt to randomize the hash value.

Now it's not the salt you sprinkle on your French fries.

Salt in cryptography refers to random data that you include with the input for

your hash function.

A salt should be randomly generated for each password.

The salt is concatenated or added to the password and

then processed by whichever cryptographic hash function you're using.

The output of that function is stored in the database as well as the salt itself.

For hashing passwords in this project, we'll be using the Bcrypt node package.

As noted on the project's website Bcrypt is a cross-platform encryption utility.

It's a popular option with the nodeJS community when hashing user passwords.

We should always keep our users data safe and secure.

Hashing passwords and

using a salt are very important when developing an authentication system.

In the next video, we'll move forward with utilizing Bcrypt.

We'll also add methods to our user model to create the hash value we'll store in

the database.