Why are my passwords not being hashed? - express

Question

With the code below, I am able to successfully add a new user. However, when I look at users in the database, the password is in plain text. Obviously I'm doing something wrong.
In the section where let newUser = new User, the password is passed in from the request body. If there are no errors, bcrypt should hash the password and set the newUser.password to the hash value, right?
//ADD USER Submit POST Route
router.post('/register',
[
check('name').isLength({min:1}).trim().withMessage('Name
required'),
check('email').isLength({min:1}).trim().withMessage('Email
required'),
check('email').isEmail().trim().withMessage('Email is not valid'),
check('password').isLength({min:1}).withMessage('Password
required'),
check('password').custom((value,{req, loc, path}) => {
if (value !== req.body.password2) {
// throw error if passwords do not match
throw new Error("Passwords do not match");
} else {
return value;
}
})
],
(req,res,next)=>{
let newUser = new User({
name:req.body.name,
email:req.body.email,
username:req.body.username,
password: req.body.password
});
const errors = validationResult(req);
if (!errors.isEmpty()) {
console.log(errors);
res.render('register',
{
newUser:newUser,
errors: errors.mapped()
});
}
else{
bcrypt.genSalt(10, function(err, salt) {
bcrypt.hash(newUser.password, salt, function(err, hash) {
if(err) {
console.log(err);
}
newUser.name = req.body.name;
newUser.email = req.body.email;
newUser.username = req.body.username;
newUser.password = hash;
})
})
newUser.save(err=>{
if(err)throw err;
req.flash('success','You are now registered and can log in');
res.redirect('/users/login');
});
}
});
Any suggestions would be greatly appreciated. Thanks!

Answer 1

Move you newUser.save inside the bcrypt.hash callback. The save gets hit first and a user is created in database before the bcrypt finishes and runs the callback.
Also inside the callback of bcrypt.hash you don't need to do the following again:
newUser.name = req.body.name;
newUser.email = req.body.email;
newUser.username = req.body.username;
Try following:
(req,res,next)=>{
let newUser = new User({
name:req.body.name,
email:req.body.email,
username:req.body.username,
password: req.body.password
});
const errors = validationResult(req);
if (!errors.isEmpty()) {
console.log(errors);
res.render('register',
{
newUser:newUser,
errors: errors.mapped()
});
}
else{
bcrypt.genSalt(10, function(err, salt) {
bcrypt.hash(newUser.password, salt, function(err, hash) {
if(err) {
console.log(err);
}
newUser.password = hash;
newUser.save(err=>{
if(err)throw err;
req.flash('success','You are now registered and can log in');
res.redirect('/users/login');
});
})
})
}