WebFund 2013W: Authenticated Sessions - Revision history

Soma at 19:51, 8 March 2013

2013-03-08T19:51:06Z

← Older revision		Revision as of 19:51, 8 March 2013
Line 3:		Line 3:
	The sample express application is [http://homeostasis.scs.carleton.ca/~soma/webfund-2013w/demo-auth-hash.zip demo-auth-hash]. It behaves similarly to the [[WebFund_2013W:_Sessions\|sessions tutorial]] from two weeks ago. The only difference here, though, is the server doesn't store plaintext passwords, and it stores them in MongoDB.		The sample express application is [http://homeostasis.scs.carleton.ca/~soma/webfund-2013w/demo-auth-hash.zip demo-auth-hash]. It behaves similarly to the [[WebFund_2013W:_Sessions\|sessions tutorial]] from two weeks ago. The only difference here, though, is the server doesn't store plaintext passwords, and it stores them in MongoDB.

	~~'''Note for Windows users:''' This~~ code ~~uses OpenSSL's implementation of bcrypt~~. ~~Thus building this on the lab Windows machines is difficult because OpenSSL is not installed~~. ~~See [https://npmjs~~.~~org/package/bcrypt the node bcrypt package documentation] for more information~~.		You should get the application running, look at the code, and then attempt to answer the following questions about this code. Expect to see modified versions of these questions soon...

	(A reasonable question here is, why not use a JavaScript implementation of the crypto primitives? They do exist; however, you should always use CERTIFIED IMPLEMENTATIONS of cryptography in your applications. If it hasn't been properly tested and evaluated, you are running very very serious risks. Friends don't let friends implement cryptography for anything except personal entertainment!)		===Note for Windows users===

			This code uses OpenSSL's implementation of bcrypt. Thus building this on the lab Windows machines is difficult because OpenSSL is not installed. See [https://npmjs.org/package/bcrypt the node bcrypt package documentation] for more information on how to use this on Windows.

			A reasonable question here is, why not use a JavaScript implementation of the crypto primitives? They do exist; however, you should always use CERTIFIED IMPLEMENTATIONS of cryptography in your applications. If it hasn't been properly tested and evaluated, you are running very very serious risks. Friends don't let friends implement cryptography for anything except personal entertainment!

			Having said that, you should be able to get the code working using pure JavaScript with the [https://npmjs.org/package/bcrypt-nodejs bcrypt-nodejs] package with minor changes to the application.

	~~You should get the application running, look at the code, and then attempt to answer the following questions about this code. Expect to see modified versions of these questions soon...~~

	==Questions==		==Questions==

Soma at 19:44, 8 March 2013

2013-03-08T19:44:59Z

← Older revision		Revision as of 19:44, 8 March 2013
Line 4:		Line 4:

	'''Note for Windows users:''' This code uses OpenSSL's implementation of bcrypt. Thus building this on the lab Windows machines is difficult because OpenSSL is not installed. See [https://npmjs.org/package/bcrypt the node bcrypt package documentation] for more information.		'''Note for Windows users:''' This code uses OpenSSL's implementation of bcrypt. Thus building this on the lab Windows machines is difficult because OpenSSL is not installed. See [https://npmjs.org/package/bcrypt the node bcrypt package documentation] for more information.

			(A reasonable question here is, why not use a JavaScript implementation of the crypto primitives? They do exist; however, you should always use CERTIFIED IMPLEMENTATIONS of cryptography in your applications. If it hasn't been properly tested and evaluated, you are running very very serious risks. Friends don't let friends implement cryptography for anything except personal entertainment!)

	You should get the application running, look at the code, and then attempt to answer the following questions about this code. Expect to see modified versions of these questions soon...		You should get the application running, look at the code, and then attempt to answer the following questions about this code. Expect to see modified versions of these questions soon...

Soma at 19:39, 8 March 2013

2013-03-08T19:39:54Z

← Older revision		Revision as of 19:39, 8 March 2013
Line 2:		Line 2:

	The sample express application is [http://homeostasis.scs.carleton.ca/~soma/webfund-2013w/demo-auth-hash.zip demo-auth-hash]. It behaves similarly to the [[WebFund_2013W:_Sessions\|sessions tutorial]] from two weeks ago. The only difference here, though, is the server doesn't store plaintext passwords, and it stores them in MongoDB.		The sample express application is [http://homeostasis.scs.carleton.ca/~soma/webfund-2013w/demo-auth-hash.zip demo-auth-hash]. It behaves similarly to the [[WebFund_2013W:_Sessions\|sessions tutorial]] from two weeks ago. The only difference here, though, is the server doesn't store plaintext passwords, and it stores them in MongoDB.

			'''Note for Windows users:''' This code uses OpenSSL's implementation of bcrypt. Thus building this on the lab Windows machines is difficult because OpenSSL is not installed. See [https://npmjs.org/package/bcrypt the node bcrypt package documentation] for more information.

	You should get the application running, look at the code, and then attempt to answer the following questions about this code. Expect to see modified versions of these questions soon...		You should get the application running, look at the code, and then attempt to answer the following questions about this code. Expect to see modified versions of these questions soon...

Soma at 18:48, 8 March 2013

2013-03-08T18:48:36Z

← Older revision		Revision as of 18:48, 8 March 2013
Line 1:		Line 1:
	In this tutorial you'll be looking at how authenticated sessions can be done in Node. Note that this example '''sends passwords in the clear to the server'''. If you wanted to prevent this, you would need to add SSL support to your application.		In this tutorial you'll be looking at how authenticated sessions can be done in Node. Note that this example '''sends passwords in the clear to the server'''. If you wanted to prevent this, you would need to add SSL support to your application, e.g., using the [http://nodejs.org/api/https.html https npm module].

	The sample express application is [http://homeostasis.scs.carleton.ca/~soma/webfund-2013w/demo-auth-hash.zip demo-auth-hash]. It behaves similarly to the [[WebFund_2013W:_Sessions\|sessions tutorial]] from two weeks ago. The only difference here, though, is the server doesn't store plaintext passwords, and it stores them in MongoDB.		The sample express application is [http://homeostasis.scs.carleton.ca/~soma/webfund-2013w/demo-auth-hash.zip demo-auth-hash]. It behaves similarly to the [[WebFund_2013W:_Sessions\|sessions tutorial]] from two weeks ago. The only difference here, though, is the server doesn't store plaintext passwords, and it stores them in MongoDB.

Soma: /* Questions */

2013-03-08T18:27:15Z

Questions

← Older revision		Revision as of 18:27, 8 March 2013
Line 6:		Line 6:

	==Questions==		==Questions==

			# How do you get MongoDB up and running on your box?
			# This app requires two packages that directly access MongoDB. What are they?
			# What is the name of the MongoDB collection that is used to store usernames and hash passwords?
			# What MongoDB collection is used to store session information?
			# How long before this app's session cookies expire?
			# Once the application is running successfully, kill the MongoDB server and see how the application behaves when you attempt to register a new user. Does it "succeed" or does it report an error? Is the user properly registered?
			# In the POST function for /login, it processes a username and password supplied by the user. How are they accessed? Where did this information come from?
			# What CSS templating language does this application use?
			# What is MongoStore storing? What node component(s) are using it?
			# Change the app to use raw MongoDB calls rather than Mongoose for storing the username and password. How much harder is it to do this?

Soma at 17:39, 8 March 2013

2013-03-08T17:39:54Z

← Older revision		Revision as of 17:39, 8 March 2013
Line 3:		Line 3:
	The sample express application is [http://homeostasis.scs.carleton.ca/~soma/webfund-2013w/demo-auth-hash.zip demo-auth-hash]. It behaves similarly to the [[WebFund_2013W:_Sessions\|sessions tutorial]] from two weeks ago. The only difference here, though, is the server doesn't store plaintext passwords, and it stores them in MongoDB.		The sample express application is [http://homeostasis.scs.carleton.ca/~soma/webfund-2013w/demo-auth-hash.zip demo-auth-hash]. It behaves similarly to the [[WebFund_2013W:_Sessions\|sessions tutorial]] from two weeks ago. The only difference here, though, is the server doesn't store plaintext passwords, and it stores them in MongoDB.

	You should get the application running and ~~you should~~ attempt to answer the following questions about this code. Expect to see modified versions of these questions soon...		You should get the application running, look at the code, and then attempt to answer the following questions about this code. Expect to see modified versions of these questions soon...

			==Questions==

Soma at 17:39, 8 March 2013

2013-03-08T17:39:31Z

← Older revision		Revision as of 17:39, 8 March 2013
Line 1:		Line 1:
	In this tutorial you'll be looking at how authenticated sessions can be done in Node. Note that this example '''sends passwords in the clear to the server'''. If you wanted to prevent this, you would need to add SSL support to your application.		In this tutorial you'll be looking at how authenticated sessions can be done in Node. Note that this example '''sends passwords in the clear to the server'''. If you wanted to prevent this, you would need to add SSL support to your application.

	The sample express application is [http://homeostasis.scs.carleton.ca/~soma/webfund-2013w/demo-auth-hash.zip]. It behaves similarly to the [[WebFund_2013W:_Sessions\|sessions tutorial]] from two weeks ago. The only difference here, though, is the server doesn't store plaintext passwords, and it stores them in MongoDB.		The sample express application is [http://homeostasis.scs.carleton.ca/~soma/webfund-2013w/demo-auth-hash.zip demo-auth-hash]. It behaves similarly to the [[WebFund_2013W:_Sessions\|sessions tutorial]] from two weeks ago. The only difference here, though, is the server doesn't store plaintext passwords, and it stores them in MongoDB.

	You should get the application running and you should attempt to answer the following questions about this code. Expect to see modified versions of these questions soon...		You should get the application running and you should attempt to answer the following questions about this code. Expect to see modified versions of these questions soon...

Soma at 17:39, 8 March 2013

2013-03-08T17:39:03Z

← Older revision		Revision as of 17:39, 8 March 2013
Line 2:		Line 2:

	The sample express application is [http://homeostasis.scs.carleton.ca/~soma/webfund-2013w/demo-auth-hash.zip]. It behaves similarly to the [[WebFund_2013W:_Sessions\|sessions tutorial]] from two weeks ago. The only difference here, though, is the server doesn't store plaintext passwords, and it stores them in MongoDB.		The sample express application is [http://homeostasis.scs.carleton.ca/~soma/webfund-2013w/demo-auth-hash.zip]. It behaves similarly to the [[WebFund_2013W:_Sessions\|sessions tutorial]] from two weeks ago. The only difference here, though, is the server doesn't store plaintext passwords, and it stores them in MongoDB.

			You should get the application running and you should attempt to answer the following questions about this code. Expect to see modified versions of these questions soon...

Soma: Created page with "In this tutorial you'll be looking at how authenticated sessions can be done in Node. Note that this example '''sends passwords in the clear to the server'''. If you wanted ..."

2013-03-08T17:28:14Z

Created page with "In this tutorial you'll be looking at how authenticated sessions can be done in Node. Note that this example '''sends passwords in the clear to the server'''. If you wanted ..."

New page

In this tutorial you'll be looking at how authenticated sessions can be done in Node. Note that this example '''sends passwords in the clear to the server'''. If you wanted to prevent this, you would need to add SSL support to your application.

The sample express application is [http://homeostasis.scs.carleton.ca/~soma/webfund-2013w/demo-auth-hash.zip]. It behaves similarly to the [[WebFund_2013W:_Sessions|sessions tutorial]] from two weeks ago. The only difference here, though, is the server doesn't store plaintext passwords, and it stores them in MongoDB.