Password validators operate on hashed password, making `length` validators useless

[STRML]

Modifying the User model in the following way does not trigger a validation error when attempting to create a user with an invalid password:

var User = app.models.User;
User.validatesLengthOf('password', {min: 6, message: {min: 'Password is too short'}});
var u = new User({email: "foo@bar.com", password: "short"});
assert(u.isValid()) // Error

Tracing it with node-inspector shows that the length is being compared to the hashed password, which is obviously always quite long.

[ritch]

Thanks for the bug report. We probably have to implement a custom validator for the password field. The length is lost as soon as the value is set. I'm thinking of moving the validation to the setter to prevent ever setting an invalid password. The issue is that the validator doesn't support this.

[bajtos]

Mailing-list discussion: https://groups.google.com/forum/#!topic/loopbackjs/SdWN5n3hMzw

[jonathanxie]

I'm not too familiar with the internals of loopback yet, but for this bug, I'm wondering if this will work for a fix in user.js

I tried to put some code in the UserMode.beforeRemote('create',...) method to do the hashing but that didn't work.

 UserModel.setter.password = function(plain) {
 //var salt = bcrypt.genSaltSync(this.constructor.settings.saltWorkFactor || SALT_WORK_FACTOR);
 //this.$password = bcrypt.hashSync(plain, salt);
 this.$password = plain;
 };

 UserModel.beforeCreate = function(next, user) {
 var password = user.password;
 console.log("user.password before hash = ", password);
 var salt = bcrypt.genSaltSync(this.constructor.settings.saltWorkFactor || SALT_WORK_FACTOR);
 user.password = bcrypt.hashSync(user.password, salt);
 console.log("user.password after hash = ", password);
 next();
 };

 // Make sure emailVerified is not set by creation
 UserModel.beforeRemote('create', function(ctx, user, next) {
 var body = ctx.req.body;
 if (body && body.emailVerified) {
 body.emailVerified = false;
 }
 next();
 });

[jonathanxie]

Actually, what I posted isn't going to work because if I call UserModel.beforeCreate here, and then I call beforeCreate in a custom Model that extends LoopBack's built-in User model and user.js file, then the createModel defined in Loopback's user.js file won't ever get called.

So for a workaround, I just did the following:

 UserModel.setter.password = function(plain) {
 //var salt = bcrypt.genSaltSync(this.constructor.settings.saltWorkFactor || SALT_WORK_FACTOR);
 //this.$password = bcrypt.hashSync(plain, salt);
 this.$password = plain;
 };

And then in my file that extends the built-in User model, I did this:

 UserModel.beforeCreate = function(next, user) {
 var password = user.password;
 console.log("user.password before hash = ", password);
 var salt = bcrypt.genSaltSync(this.constructor.settings.saltWorkFactor || SALT_WORK_FACTOR);
 user.password = bcrypt.hashSync(user.password, salt);
 console.log("user.password after hash = ", password);
 next();
 };

Works for a temporary workaround solution for now...