WebFund 2014W: Tutorial 4 - Revision history

Mbingham at 13:59, 31 January 2014

2014-01-31T13:59:23Z

← Older revision		Revision as of 13:59, 31 January 2014
Line 43:		Line 43:
	show dbs		show dbs
	show collections		show collections
	use auth-~~session~~-demo		use auth-hash-demo
	db.sessions.find()		db.sessions.find()
	db.users.find()		db.users.find()
	db.system.indexes.find()		db.system.indexes.find()

Soma at 17:48, 30 January 2014

2014-01-30T17:48:53Z

← Older revision		Revision as of 17:48, 30 January 2014
Line 6:		Line 6:
	Because we are using SSL, you will need to connect to https://localhost:3000 rather than the standard http address. You will also get a warning about the self-signed certificate; this is normal. However, you may want to try examining the certificate to see what information it contains.		Because we are using SSL, you will need to connect to https://localhost:3000 rather than the standard http address. You will also get a warning about the self-signed certificate; this is normal. However, you may want to try examining the certificate to see what information it contains.

	The sample express application is [http://homeostasis.scs.carleton.ca/~soma/webfund-2014w/T4/auth-ssl-demo.zip auth-ssl-demo].		The sample express application is [http://homeostasis.scs.carleton.ca/~soma/webfund-2014w/T4/auth-ssl-demo.zip auth-ssl-demo].

	~~Note that if~~ you were doing authentication in a real application, you should probably use a more mature solution like [http://everyauth.com/ everyauth] or [http://passportjs.org/ Passport]; however, this solution does follow standard practice of storing the password in a form that is (somewhat) hard to reverse (hashed and salted) and we are only transmitting it over an encrypted channel.		If you were doing authentication in a real application, you should probably use a more mature solution like [http://everyauth.com/ everyauth] or [http://passportjs.org/ Passport]; however, this solution does follow standard practice of storing the password in a form that is (somewhat) hard to reverse (hashed and salted) and we are only transmitting it over an encrypted channel.

	You should get the application running, look at the code, and then attempt to answer the questions below about the code and make the suggested modifications.		You should get the application running, look at the code, and then attempt to answer the questions below about the code and make the suggested modifications.

	===~~Note for Windows users~~===		===Running the code outside of the class VM===

	~~This~~ code uses OpenSSL's implementation of bcrypt. Thus building this on Windows machines can be tricky if OpenSSL is not installed. See [https://npmjs.org/package/bcrypt the node bcrypt package documentation] for more information on how to ~~use this~~ on Windows.		Note that if you are running this code outside of the class VM, you will probably need to delete the node_modules directory and run <tt>npm install</tt> as some of the modules for this class use native code. In particular, this code uses OpenSSL's implementation of bcrypt.

			<tt>npm install</tt> should work fine on Linux as they often include OpenSSL as part of the standard development environment.
			Thus building this on Windows machines can be tricky, however, as OpenSSL is not installed normally; you'll have to install it separately in addition to Visual Studio. See [https://npmjs.org/package/bcrypt the node bcrypt package documentation] for more information on how to get it to run on Windows.

	A reasonable question here is, why not use a JavaScript implementation of the crypto primitives? They do exist; however, you should always use CERTIFIED IMPLEMENTATIONS of cryptography in your applications. If it hasn't been properly tested and evaluated, you are running very very serious risks. Friends don't let friends implement cryptography for anything except personal entertainment!		A reasonable question here is, why not use a JavaScript implementation of the crypto primitives? They do exist; however, you should always use CERTIFIED IMPLEMENTATIONS of cryptography in your applications. If it hasn't been properly tested and evaluated, you are running very very serious risks. Friends don't let friends implement cryptography for anything except personal entertainment!
Line 37:		Line 40:
	# What is <tt>toArray()</tt> doing in the calls to <tt>find()</tt>? Specifically, what does the syntax mean, and why is the toArray() call necessary?		# What is <tt>toArray()</tt> doing in the calls to <tt>find()</tt>? Specifically, what does the syntax mean, and why is the toArray() call necessary?
	# Type <tt>mongo</tt> to connect to the running mongodb instance on your machine. What do the following commands do? What does this show you about how passwords are stored in this application?		# Type <tt>mongo</tt> to connect to the running mongodb instance on your machine. What do the following commands do? What does this show you about how passwords are stored in this application?
			help
	show dbs		show dbs
	show collections		show collections

Soma: /* Questions */

2014-01-30T03:56:08Z

Questions

← Older revision		Revision as of 03:56, 30 January 2014
Line 36:		Line 36:
	# The <tt>routes.register()</tt> has multiple nested functions. What do each of them do, and why are they nested the way they are?		# The <tt>routes.register()</tt> has multiple nested functions. What do each of them do, and why are they nested the way they are?
	# What is <tt>toArray()</tt> doing in the calls to <tt>find()</tt>? Specifically, what does the syntax mean, and why is the toArray() call necessary?		# What is <tt>toArray()</tt> doing in the calls to <tt>find()</tt>? Specifically, what does the syntax mean, and why is the toArray() call necessary?
	# Type <tt>mongo</tt> to connect to the running mongodb instance on your machine. What do the following commands do?		# Type <tt>mongo</tt> to connect to the running mongodb instance on your machine. What do the following commands do? What does this show you about how passwords are stored in this application?
	show dbs		show dbs
	show collections		show collections

Soma: /* Questions */

2014-01-30T03:54:04Z

Questions

← Older revision		Revision as of 03:54, 30 January 2014
Line 37:		Line 37:
	# What is <tt>toArray()</tt> doing in the calls to <tt>find()</tt>? Specifically, what does the syntax mean, and why is the toArray() call necessary?		# What is <tt>toArray()</tt> doing in the calls to <tt>find()</tt>? Specifically, what does the syntax mean, and why is the toArray() call necessary?
	# Type <tt>mongo</tt> to connect to the running mongodb instance on your machine. What do the following commands do?		# Type <tt>mongo</tt> to connect to the running mongodb instance on your machine. What do the following commands do?
	show dbs		show dbs
	show collections		show collections
	use auth-session-demo		use auth-session-demo
	db.sessions.find()		db.sessions.find()
	db.users.find()		db.users.find()
	db.system.indexes.find()		db.system.indexes.find()

Soma: /* Questions */

2014-01-30T03:53:31Z

Questions

← Older revision		Revision as of 03:53, 30 January 2014
Line 35:		Line 35:
	# How can you change this app to list all of the currently logged in users on /users?		# How can you change this app to list all of the currently logged in users on /users?
	# The <tt>routes.register()</tt> has multiple nested functions. What do each of them do, and why are they nested the way they are?		# The <tt>routes.register()</tt> has multiple nested functions. What do each of them do, and why are they nested the way they are?
	# What is <tt>toArray()</tt> doing in the calls to <tt>find()</tt>? Specifically, what does the syntax mean, and why is the toArray call necessary?		# What is <tt>toArray()</tt> doing in the calls to <tt>find()</tt>? Specifically, what does the syntax mean, and why is the toArray() call necessary?
			# Type <tt>mongo</tt> to connect to the running mongodb instance on your machine. What do the following commands do?
			show dbs
			show collections
			use auth-session-demo
			db.sessions.find()
			db.users.find()
			db.system.indexes.find()

Soma: /* Questions */

2014-01-30T03:44:50Z

Questions

← Older revision		Revision as of 03:44, 30 January 2014
Line 35:		Line 35:
	# How can you change this app to list all of the currently logged in users on /users?		# How can you change this app to list all of the currently logged in users on /users?
	# The <tt>routes.register()</tt> has multiple nested functions. What do each of them do, and why are they nested the way they are?		# The <tt>routes.register()</tt> has multiple nested functions. What do each of them do, and why are they nested the way they are?
	#		# What is <tt>toArray()</tt> doing in the calls to <tt>find()</tt>? Specifically, what does the syntax mean, and why is the toArray call necessary?

Soma: Created page with "In this tutorial we will be playing with a program that is similar to last tutorial's sessions demo except that we now: * authenticate the user w..."

2014-01-30T03:42:21Z

Created page with "In this tutorial we will be playing with a program that is similar to last tutorial's sessions demo except that we now: * authenticate the user w..."

New page

In this tutorial we will be playing with a program that is similar to last tutorial's [[WebFund 2014W: Tutorial 3|sessions demo]] except that we now:
* authenticate the user with a password,
* secure communication using https (using a self-signed SSL certificate), and
* have persistence across server restarts.

Because we are using SSL, you will need to connect to https://localhost:3000 rather than the standard http address. You will also get a warning about the self-signed certificate; this is normal. However, you may want to try examining the certificate to see what information it contains.

The sample express application is [http://homeostasis.scs.carleton.ca/~soma/webfund-2014w/T4/auth-ssl-demo.zip auth-ssl-demo].

Note that if you were doing authentication in a real application, you should probably use a more mature solution like [http://everyauth.com/ everyauth] or [http://passportjs.org/ Passport]; however, this solution does follow standard practice of storing the password in a form that is (somewhat) hard to reverse (hashed and salted) and we are only transmitting it over an encrypted channel.

You should get the application running, look at the code, and then attempt to answer the questions below about the code and make the suggested modifications.

===Note for Windows users===

This code uses OpenSSL's implementation of bcrypt. Thus building this on Windows machines can be tricky if OpenSSL is not installed. See [https://npmjs.org/package/bcrypt the node bcrypt package documentation] for more information on how to use this on Windows.

A reasonable question here is, why not use a JavaScript implementation of the crypto primitives? They do exist; however, you should always use CERTIFIED IMPLEMENTATIONS of cryptography in your applications. If it hasn't been properly tested and evaluated, you are running very very serious risks. Friends don't let friends implement cryptography for anything except personal entertainment!

Having said that, you should be able to get the code working using pure JavaScript with [https://npmjs.org/package/bcryptjs bcryptjs] or [https://npmjs.org/package/bcrypt-nodejs bcrypt-nodejs] packages with minor changes to the application.

==Questions==

You will get full credit for this tutorial for attending and showing a TA that you can at least answer a few of the questions below. You are highly encouraged, though, to try and answer all of the following during tutorial.

# What is the difference between the Login and Register button on the initial screen? Do they work the same way?
# Generate your own SSL certificate for the application. How do you know you succeeded?
# MongoDB's "tables" are collections; they are grouped together into databases. What MongoDB database is used by this application? What collections?
# How long before this app's session cookies expire?
# Do sessions and user accounts persist across web application restarts?
# Once the application is running successfully, kill the MongoDB server and see how the application behaves when you attempt to register a new user. Does it "succeed" or does it report an error? Is the user properly registered? (You can stop and start the server in the VM using the command <tt>sudo service mongodb stop</tt> and <tt>sudo service mongodb start</tt>, respectively.)
# In the POST function for /login, it processes a username and password supplied by the user. How are they accessed? Where did this information come from? And, are they validated in any way?
# Why are there three arguments to the app.get()'s, rather than the previous two?
# How can you change this app to list all of the currently logged in users on /users?
# The <tt>routes.register()</tt> has multiple nested functions. What do each of them do, and why are they nested the way they are?
#