WebFund 2013F: Tutorial 11 - Revision history

Soma: /* Questions */

2013-11-22T16:53:42Z

Questions

← Older revision		Revision as of 16:53, 22 November 2013
Line 26:		Line 26:
	# How long before this app's session cookies expire?		# How long before this app's session cookies expire?
	# Verify that sessions and user accounts persist across web application restarts.		# Verify that sessions and user accounts persist across web application restarts.
	# Once the application is running successfully, kill the MongoDB server and see how the application behaves when you attempt to register a new user. Does it "succeed" or does it report an error? Is the user properly registered?		# Once the application is running successfully, kill the MongoDB server and see how the application behaves when you attempt to register a new user. Does it "succeed" or does it report an error? Is the user properly registered? (You can stop and start the server in the VM using the command <tt>sudo service mongodb stop</tt> and <tt>sudo service mongodb start</tt>, respectively.)
	# In the POST function for /login, it processes a username and password supplied by the user. How are they accessed? Where did this information come from? And, are they validated in any way?		# In the POST function for /login, it processes a username and password supplied by the user. How are they accessed? Where did this information come from? And, are they validated in any way?
	# What CSS templating language does this application use?		# What CSS templating language does this application use?
	# What is MongoStore storing? What node component(s) are using it?		# What is MongoStore storing? What node component(s) are using it?
	# Change the app to use raw MongoDB calls rather than Mongoose for storing the username and password. How much harder is it to do this?		# Change the app to use raw MongoDB calls rather than Mongoose for storing the username and password. How much harder is it to do this?

Soma: /* Questions */

2013-11-22T03:11:49Z

Questions

← Older revision		Revision as of 03:11, 22 November 2013
Line 25:		Line 25:
	# What MongoDB collection is used to store session information?		# What MongoDB collection is used to store session information?
	# How long before this app's session cookies expire?		# How long before this app's session cookies expire?
			# Verify that sessions and user accounts persist across web application restarts.
	# Once the application is running successfully, kill the MongoDB server and see how the application behaves when you attempt to register a new user. Does it "succeed" or does it report an error? Is the user properly registered?		# Once the application is running successfully, kill the MongoDB server and see how the application behaves when you attempt to register a new user. Does it "succeed" or does it report an error? Is the user properly registered?
	# In the POST function for /login, it processes a username and password supplied by the user. How are they accessed? Where did this information come from? And, are they validated in any way?		# In the POST function for /login, it processes a username and password supplied by the user. How are they accessed? Where did this information come from? And, are they validated in any way?

Soma: /* Questions */

2013-11-22T03:11:06Z

Questions

← Older revision		Revision as of 03:11, 22 November 2013
Line 20:		Line 20:

	# What is the difference between the Login and Register button on the initial screen?		# What is the difference between the Login and Register button on the initial screen?
			# Generate your own SSL certificate for the application. How do you know you succeeded?
	# This app requires two packages that directly access MongoDB. What are they?		# This app requires two packages that directly access MongoDB. What are they?
	# What is the name of the MongoDB collection that is used to store usernames and hash passwords?		# What is the name of the MongoDB collection that is used to store usernames and hash passwords?

Soma at 03:08, 22 November 2013

2013-11-22T03:08:53Z

← Older revision		Revision as of 03:08, 22 November 2013
Line 6:		Line 6:

	You should get the application running, look at the code, and then attempt to answer the questions below about the code and make the suggested modifications.		You should get the application running, look at the code, and then attempt to answer the questions below about the code and make the suggested modifications.


	===Note for Windows users===		===Note for Windows users===
Line 15:		Line 14:

	Having said that, you should be able to get the code working using pure JavaScript with [https://npmjs.org/package/bcryptjs bcryptjs] or [https://npmjs.org/package/bcrypt-nodejs bcrypt-nodejs] packages with minor changes to the application.		Having said that, you should be able to get the code working using pure JavaScript with [https://npmjs.org/package/bcryptjs bcryptjs] or [https://npmjs.org/package/bcrypt-nodejs bcrypt-nodejs] packages with minor changes to the application.


	==Questions==		==Questions==

Soma at 03:06, 22 November 2013

2013-11-22T03:06:31Z

← Older revision		Revision as of 03:06, 22 November 2013
Line 1:		Line 1:
	~~'''This tutorial is not yet finalized.'''~~

	In this tutorial you'll be looking at how authenticated sessions can be done in Node. Note that this example uses SSL to protect passwords being sent to the server. Thus, you will need to connect to https://localhost:3000 rather than the standard http address. You will also get a warning about the self-signed certificate; this is normal. However, you may want to try examining the certificate to see what information it contains.		In this tutorial you'll be looking at how authenticated sessions can be done in Node. Note that this example uses SSL to protect passwords being sent to the server. Thus, you will need to connect to https://localhost:3000 rather than the standard http address. You will also get a warning about the self-signed certificate; this is normal. However, you may want to try examining the certificate to see what information it contains.

	Note that if you were doing authentication in a real application, you should probably use a more mature solution like [http://everyauth.com/ everyauth] or [http://passportjs.org/ Passport]; however, this solution does follow standard practice of storing the password in a form that is (somewhat) hard to reverse (hashed and salted) and it uses SSL.		Note that if you were doing authentication in a real application, you should probably use a more mature solution like [http://everyauth.com/ everyauth] or [http://passportjs.org/ Passport]; however, this solution does follow standard practice of storing the password in a form that is (somewhat) hard to reverse (hashed and salted) and it uses SSL.

	The sample express application is demo-auth-hash-ssl. You can download it [http://homeostasis.scs.carleton.ca/~soma/webfund-2013f/demo-auth-hash-ssl.withmods.zip with modules] or [http://homeostasis.scs.carleton.ca/~soma/webfund-2013f/demo-auth-hash-ssl.zip without]. It behaves similarly to the [[WebFund 2013F: Tutorial 5\|sessions ~~tutorial~~]] from October 4th, except that sessions and users are persistent across server restarts in addition to the use of password authentication.		The sample express application is demo-auth-hash-ssl. You can download it [http://homeostasis.scs.carleton.ca/~soma/webfund-2013f/demo-auth-hash-ssl.withmods.zip with modules] or [http://homeostasis.scs.carleton.ca/~soma/webfund-2013f/demo-auth-hash-ssl.zip without]. It behaves similarly to the [[WebFund 2013F: Tutorial 5\|sessions demo]] from October 4th, except that sessions and users are persistent across server restarts in addition to the use of password authentication.

	You should get the application running, look at the code, and then attempt to answer the questions below about the code and make the suggested modifications.		You should get the application running, look at the code, and then attempt to answer the questions below about the code and make the suggested modifications.

Soma at 03:05, 22 November 2013

2013-11-22T03:05:51Z

Soma: Created page with "'''This tutorial is not yet finalized.''' In this tutorial you'll be looking at how authenticated sessions can be done in Node. Note that this example '''sends passwords in ..."

2013-11-22T00:00:05Z

Created page with "'''This tutorial is not yet finalized.''' In this tutorial you'll be looking at how authenticated sessions can be done in Node. Note that this example '''sends passwords in ..."

New page

'''This tutorial is not yet finalized.'''

In this tutorial you'll be looking at how authenticated sessions can be done in Node. Note that this example '''sends passwords in the clear to the server'''. If you wanted to prevent this, you would need to add SSL support to your application, e.g., using the [http://nodejs.org/api/https.html https npm module]. Or better yet, use a more mature solution like [http://everyauth.com/ everyauth] or [http://passportjs.org/ Passport].

The sample express application is [http://homeostasis.scs.carleton.ca/~soma/webfund-2013f/demo-auth-hash.zip demo-auth-hash]. It behaves similarly to the [[WebFund 2013F: Tutorial 5|sessions tutorial]] from October 4th. The only difference here, though, is the server doesn't store plaintext passwords, and it stores them in MongoDB.

You should get the application running, look at the code, and then attempt to answer the questions below about the code and make the suggested modifications.

===Note for Windows users===

This code uses OpenSSL's implementation of bcrypt. Thus building this on Windows machines can be tricky if OpenSSL is not installed. See [https://npmjs.org/package/bcrypt the node bcrypt package documentation] for more information on how to use this on Windows.

A reasonable question here is, why not use a JavaScript implementation of the crypto primitives? They do exist; however, you should always use CERTIFIED IMPLEMENTATIONS of cryptography in your applications. If it hasn't been properly tested and evaluated, you are running very very serious risks. Friends don't let friends implement cryptography for anything except personal entertainment!

Having said that, you should be able to get the code working using pure JavaScript with [https://npmjs.org/package/bcryptjs bcryptjs] or [https://npmjs.org/package/bcrypt-nodejs bcrypt-nodejs] packages with minor changes to the application.

==Questions==

You will get full credit for this tutorial for attending and showing a TA that you can at least answer a few of the questions below. You are highly encouraged, though, to try and answer all of the following during tutorial.

# This app requires two packages that directly access MongoDB. What are they?
# What is the name of the MongoDB collection that is used to store usernames and hash passwords?
# What MongoDB collection is used to store session information?
# How long before this app's session cookies expire?
# Once the application is running successfully, kill the MongoDB server and see how the application behaves when you attempt to register a new user. Does it "succeed" or does it report an error? Is the user properly registered?
# In the POST function for /login, it processes a username and password supplied by the user. How are they accessed? Where did this information come from?
# What CSS templating language does this application use?
# What is MongoStore storing? What node component(s) are using it?
# Change the app to use raw MongoDB calls rather than Mongoose for storing the username and password. How much harder is it to do this?

← Older revision		Revision as of 03:05, 22 November 2013
Line 1:		Line 1:
	'''This tutorial is not yet finalized.'''		'''This tutorial is not yet finalized.'''

	In this tutorial you'll be looking at how authenticated sessions can be done in Node. Note that this example ~~'''sends~~ passwords ~~in the clear~~ to the server~~'''~~. ~~If you wanted to prevent this~~, you ~~would~~ need to ~~add SSL support~~ to ~~your application, e.g., using the [http~~://~~nodejs~~.~~org/api/https.html https npm module]~~. ~~Or better yet~~, ~~use a more mature solution like [http://everyauth.com/ everyauth] or [http://passportjs.org/ Passport]~~.		In this tutorial you'll be looking at how authenticated sessions can be done in Node. Note that this example uses SSL to protect passwords being sent to the server. Thus, you will need to connect to https://localhost:3000 rather than the standard http address. You will also get a warning about the self-signed certificate; this is normal. However, you may want to try examining the certificate to see what information it contains.

	The sample express application is [http://homeostasis.scs.carleton.ca/~soma/webfund-2013f/demo-auth-hash.zip demo-auth-hash]. It behaves similarly to the [[WebFund 2013F: Tutorial 5\|sessions tutorial]] from October 4th~~. The only difference here~~, ~~though, is the~~ server ~~doesn't store plaintext passwords, and it stores them~~ in ~~MongoDB~~.		Note that if you were doing authentication in a real application, you should probably use a more mature solution like [http://everyauth.com/ everyauth] or [http://passportjs.org/ Passport]; however, this solution does follow standard practice of storing the password in a form that is (somewhat) hard to reverse (hashed and salted) and it uses SSL.

			The sample express application is demo-auth-hash-ssl. You can download it [http://homeostasis.scs.carleton.ca/~soma/webfund-2013f/demo-auth-hash-ssl.withmods.zip with modules] or [http://homeostasis.scs.carleton.ca/~soma/webfund-2013f/demo-auth-hash-ssl.zip without]. It behaves similarly to the [[WebFund 2013F: Tutorial 5\|sessions tutorial]] from October 4th, except that sessions and users are persistent across server restarts in addition to the use of password authentication.

	You should get the application running, look at the code, and then attempt to answer the questions below about the code and make the suggested modifications.		You should get the application running, look at the code, and then attempt to answer the questions below about the code and make the suggested modifications.
Line 21:		Line 23:
	You will get full credit for this tutorial for attending and showing a TA that you can at least answer a few of the questions below. You are highly encouraged, though, to try and answer all of the following during tutorial.		You will get full credit for this tutorial for attending and showing a TA that you can at least answer a few of the questions below. You are highly encouraged, though, to try and answer all of the following during tutorial.

			# What is the difference between the Login and Register button on the initial screen?
	# This app requires two packages that directly access MongoDB. What are they?		# This app requires two packages that directly access MongoDB. What are they?
	# What is the name of the MongoDB collection that is used to store usernames and hash passwords?		# What is the name of the MongoDB collection that is used to store usernames and hash passwords?
Line 26:		Line 29:
	# How long before this app's session cookies expire?		# How long before this app's session cookies expire?
	# Once the application is running successfully, kill the MongoDB server and see how the application behaves when you attempt to register a new user. Does it "succeed" or does it report an error? Is the user properly registered?		# Once the application is running successfully, kill the MongoDB server and see how the application behaves when you attempt to register a new user. Does it "succeed" or does it report an error? Is the user properly registered?
	# In the POST function for /login, it processes a username and password supplied by the user. How are they accessed? Where did this information come from?		# In the POST function for /login, it processes a username and password supplied by the user. How are they accessed? Where did this information come from? And, are they validated in any way?
	# What CSS templating language does this application use?		# What CSS templating language does this application use?
	# What is MongoStore storing? What node component(s) are using it?		# What is MongoStore storing? What node component(s) are using it?
	# Change the app to use raw MongoDB calls rather than Mongoose for storing the username and password. How much harder is it to do this?		# Change the app to use raw MongoDB calls rather than Mongoose for storing the username and password. How much harder is it to do this?