英文:
What is the best practice for password encryption?
问题
我通常在注册控制器中加密密码。
英文:
I am a beginner Nodejs developer and When doing the authentication, I have seen some encrypt the password directly inside the signup controller function, while some encrypt the password using a middleware that triggers before the save method of mongoose.
I really can't understand the difference between 2 practices.
Can anyone tell me what is the best practice and why?
I typically encrypt password in the signup controller
答案1
得分: 1
在存储库级别进行此操作可确保不会以明文格式保存密码（通常这是最严重的安全风险）。
将来，您可以添加多种方法来创建和保存新用户或更改其密码。在控制器级别执行此操作会增加未注意到加密未在存储库级别完成的风险，从而可能以明文格式保存密码。
例如，您添加了创建带有密码的新用户的功能，然后2周后添加了重置密码的功能 - 这是不同的控制器。
英文:
Having it on Repository level ensures that no password is saved in plain format (which in general is the worst security risk you can have).
In future you can add multiple ways how to create and save new users or change their passwords. Having it on Controller level increases risk that you will not notice the encryption is not done on Repository level and you can save tha password in plain format.
i.e. you add functionality to create new user with password and 2 weeks later you add functionality to reset password - which is different controller.
通过集体智慧和协作来改善编程学习和解决问题的方式。致力于成为全球开发者共同参与的知识库，让每个人都能够通过互相帮助和分享经验来进步。
评论