Docker/codex.docs
Docker/codex.docs
1
0
Fork 0
mirror of https://github.com/codex-team/codex.docs.git synced 2025-07-21 06:09:41 +02:00
Code Issues Releases Activity

Password from env variable (#170)

Browse source 
* rm: remove the generate password file

* rm: commander package

* rm: remove the password reading from db

* feat: password hash reading from env added

* passHash replace with password

* raw password comparison added

* rm: user model and controller removed

* update: auth route and token verification

* replace multiple dotenv config with one

* .env.sample added with updated docker yml

* rm:remove the bcrypt

* readme updated with .env

* remove generatePassword from package json

* updated docs

* removed the console.log
This commit is contained in:
Umang G. Patel 2022-04-24 16:54:36 +05:30 • committed by GitHub
parent aaf2644ed4
commit 303d670c49
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
13 changed files with 53 additions and 359 deletions
Download patch file Download diff file Expand all files Collapse all files

50
src/backend/routes/auth.ts
View file

@ -1,12 +1,7 @@
import express, { Request, Response } from 'express';
import jwt from 'jsonwebtoken';
import config from 'config';
import bcrypt from 'bcrypt';
import csrf from 'csurf';
import * as dotenv from 'dotenv';
import Users from '../controllers/users';
dotenv.config();
const router = express.Router();
const csrfProtection = csrf({ cookie: true });
@ -27,10 +22,7 @@ router.get('/auth', csrfProtection, function (req: Request, res: Response) {
*/
router.post('/auth', parseForm, csrfProtection, async (req: Request, res: Response) => {
try {
const userDoc = await Users.get();
const passHash = userDoc.passHash;
if (!passHash) {
if (!process.env.PASSWORD) {
res.render('auth', {
title: 'Login page',
header: 'Password not set',
@ -40,30 +32,28 @@ router.post('/auth', parseForm, csrfProtection, async (req: Request, res: Respon
return;
}
bcrypt.compare(req.body.password, passHash, async (err, result) => {
if (err || result === false) {
res.render('auth', {
title: 'Login page',
header: 'Wrong password',
csrfToken: req.csrfToken(),
});
return;
}
const token = jwt.sign({
iss: 'Codex Team',
sub: 'auth',
iat: Date.now(),
}, passHash + config.get('secret'));
res.cookie('authToken', token, {
httpOnly: true,
expires: new Date(Date.now() + 365 * 24 * 60 * 60 * 1000), // 1 year
if (req.body.password !== process.env.PASSWORD) {
res.render('auth', {
title: 'Login page',
header: 'Wrong password',
csrfToken: req.csrfToken(),
});
res.redirect('/');
return;
}
const token = jwt.sign({
iss: 'Codex Team',
sub: 'auth',
iat: Date.now(),
}, process.env.PASSWORD + config.get('secret'));
res.cookie('authToken', token, {
httpOnly: true,
expires: new Date(Date.now() + 365 * 24 * 60 * 60 * 1000), // 1 year
});
res.redirect('/');
} catch (err) {
res.render('auth', {
title: 'Login page',