You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Automatic password hashing for your bookshelf models
Installation
After installing bookshelf-bcrypt with npm i --save bookshelf-bcrypt,
all you need to do is add it as a bookshelf plugin and enable it on your models.
letknex=require('knex')(require('./knexfile.js').development)letbookshelf=require('bookshelf')(knex)// Add the pluginbookshelf.plugin(require('bookshelf-bcrypt'))// Enable it on your modelsletUser=bookshelf.Model.extend({tableName: 'users',bcrypt: {field: 'password'}})// By default, an error will be thrown if a null/undefined password is detected. Use the following to allow null/undefined passwordsletUser=bookshelf.Model.extend({tableName: 'users',bcrypt: {field: 'password',allowEmptyPassword: true}})
Usage
Nothing fancy here, just keep using bookshelf as usual.
// Wow such h4x0r, much passwordletuser=yieldUser.forge({password: 'h4x0r'}).save()console.log(user.get('password'))// $2a$12$K2CtDP7zSGOKgjXjxD9SYey9mSZ9Udio9C95K6wCKZewSP9oBWyPO
This plugin will also hash the password again if it detects that the field
changed, so you're good to do this:
letuser=yieldUser.forge({id: 1000}).fetch()// Update the useruser.set('password','another_pwd')yielduser.save()// Password automatically hashed with the new value// You can also avoid hashing by using an optionsyielduser.save({bcrypt: false})
Settings
bookshelf-bcrypt uses 12 salt rounds by default. By default we don't try and detect
a rehash because a user may use a password that looks like a bcrypt hash. If you
add a detectBcrypt function value and it returns a truthy value, an error will be thrown.
You can also override the onRehash function in settings.
bookshelf.plugin(require('bookshelf-bcrypt'),{rounds: 10// >= 12 recommended though,detectBcrypt: password=>password.length>50,onRehash: function(){// This will avoid throwing error but be aware that you can loose// user's password if you don't know what you're doing.// The function is also binded to the model instance that raised the event// so you can use any method to better handle itconsole.warn(`Rehash detected for ${this.tableName}`)this.set('need_password_change',true)}})
Testing
git clone git@github.com:estate/bookshelf-bcrypt.git
cd bookshelf-bcrypt && npm install && npm test
About
Automatic password hashing for your bookshelf models