> For the complete documentation index, see [llms.txt](https://program.hackyourfuture.dk/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://program.hackyourfuture.dk/course-content/backend/node/week3/session-materials/10-auth-db-credentials.md).

# 10. Auth - Credentials

In this part of the session, you will add **secure password storage** and a **basic login endpoint** to the Snippets API.

We will:

* Implement a `/login` endpoint that validates a user’s credentials.
* Demonstrate why insecure passwords are a security issue
* Hash passwords using `bcrypt`.

## 1. Database: users table

We can use already existing `users` table. Username can be user `email`, while password can be stored in the `token` column.

## 2. Implement /login

Create a route (for example in `routes/auth.js`) that:

1. Reads `username` and `password` from the request body.
2. Looks up the user by username in the database.

## 3. Demonstrate security issue with the password in plain

In the implemented solution, or, using the module examples - demonstrate how fast insecure password could be cracked. You can download any of the suitable [password list](https://github.com/danielmiessler/SecLists/tree/master/Passwords/Leaked-Databases) (suggested rockyou-50.txt) and execute

`node auth-sessions-brute-force.js user_name /path/to/your/wordlist`

## 4. Install bcrypt

Install `bcrypt` in the Snippets API project and import it in your auth route module. Update at least one user with a hashed password (for example a small Node program that calls `bcrypt.hash` and update the row).

## 5. Update implementation with bicrypt

1. Modify the login functionality
2. Use `bcrypt.compare` to compare the provided password with the stored `password_hash`.
3. Returns:
   * `401 Unauthorized` with a generic error message on failure.
   * `200 OK` (or `201`) with a small success payload on success.

You do **not** need to generate tokens here yet – this is just about secure credential checking.

## 6. Hash cracking introduction

If using MD5 hashing algorythm, it is great to demonstrate that even hashed, if password is weak - it could be easily cracked Take the created password hash (considering that it was a simple password like qwerty123, password123 etc) and paste it here - [Crack Station](https://crackstation.net/)

## 7. Suggested exercises

* Add at least one extra user to the database and test logging in as both.
* Think about:
  * What error messages you send back (security vs usability).


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://program.hackyourfuture.dk/course-content/backend/node/week3/session-materials/10-auth-db-credentials.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.