WebFund 2013W: Authenticated Sessions

In this tutorial you'll be looking at how authenticated sessions can be done in Node. Note that this example sends passwords in the clear to the server. If you wanted to prevent this, you would need to add SSL support to your application, e.g., using the https npm module.

The sample express application is demo-auth-hash. It behaves similarly to the sessions tutorial from two weeks ago. The only difference here, though, is the server doesn't store plaintext passwords, and it stores them in MongoDB.

You should get the application running, look at the code, and then attempt to answer the following questions about this code. Expect to see modified versions of these questions soon...

Note for Windows users

This code uses OpenSSL's implementation of bcrypt. Thus building this on the lab Windows machines is difficult because OpenSSL is not installed. See the node bcrypt package documentation for more information on how to use this on Windows.

A reasonable question here is, why not use a JavaScript implementation of the crypto primitives? They do exist; however, you should always use CERTIFIED IMPLEMENTATIONS of cryptography in your applications. If it hasn't been properly tested and evaluated, you are running very very serious risks. Friends don't let friends implement cryptography for anything except personal entertainment!

Having said that, you should be able to get the code working using pure JavaScript with the bcrypt-nodejs package with minor changes to the application.

Questions

1. How do you get MongoDB up and running on your box?
2. This app requires two packages that directly access MongoDB. What are they?
3. What is the name of the MongoDB collection that is used to store usernames and hash passwords?
4. What MongoDB collection is used to store session information?
5. How long before this app's session cookies expire?
6. Once the application is running successfully, kill the MongoDB server and see how the application behaves when you attempt to register a new user. Does it "succeed" or does it report an error? Is the user properly registered?
7. In the POST function for /login, it processes a username and password supplied by the user. How are they accessed? Where did this information come from?
8. What CSS templating language does this application use?
9. What is MongoStore storing? What node component(s) are using it?
10. Change the app to use raw MongoDB calls rather than Mongoose for storing the username and password. How much harder is it to do this?