Password hashing with bcrypt in Express - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to import bcrypt in an Express app.

Express

const bcrypt = require('[1]');

Drag options to blanks, or click blank then click option'

Acors

Bexpress

Cbody-parser

Dbcrypt

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'express' instead of 'bcrypt' in require statement.

Forgetting to import bcrypt before using it.

We import the bcrypt library by requiring 'bcrypt'. This allows us to use bcrypt functions for password hashing.

2fill in blank

medium

Complete the code to hash a password asynchronously using bcrypt.

Express

const hashedPassword = await bcrypt.[1](password, 10);

Drag options to blanks, or click blank then click option'

Ahash

Bcompare

CgenSalt

Dverify

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'compare' instead of 'hash' to create a hash.

Not awaiting the asynchronous hash function.

The hash function creates a hashed version of the password using a salt rounds value (10 here).

3fill in blank

hard

Fix the error in the code to compare a plain password with a hashed password.

Express

const isMatch = await bcrypt.[1](password, hashedPassword);

Drag options to blanks, or click blank then click option'

Ahash

BgenSalt

Ccompare

Dencrypt

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'hash' instead of 'compare' to check passwords.

Passing arguments in wrong order.

The compare function checks if the plain password matches the hashed password.

4fill in blank

hard

Fill both blanks to generate a salt and then hash a password using that salt.

Express

const salt = await bcrypt.[1](12);
const hashed = await bcrypt.[2](password, salt);

Drag options to blanks, or click blank then click option'

AgenSalt

Bcompare

Chash

Dencrypt

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'compare' instead of 'genSalt' or 'hash'.

Not awaiting the asynchronous functions.

First, genSalt creates a salt with 12 rounds. Then, hash uses that salt to hash the password.

5fill in blank

hard

Fill all three blanks to create a function that hashes a password and returns the hashed value.

Express

async function [1](password) {
  const salt = await bcrypt.[2](10);
  const hash = await bcrypt.[3](password, salt);
  return hash;
}

Drag options to blanks, or click blank then click option'

AhashPassword

BgenSalt

Chash

Dcompare

Attempts:

3 left

💡 Hint

Common Mistakes

Naming the function incorrectly.

Mixing up the order of salt generation and hashing.

This function named hashPassword generates a salt with 10 rounds, hashes the password with that salt, and returns the hashed password.

Practice

1. What is the main purpose of using bcrypt in an Express app?

easy

A. To securely hash user passwords before saving them

B. To speed up server response time

C. To format JSON data

D. To manage user sessions

Solution

1. Step 1: Understand bcrypt's role

   Bcrypt is a library designed to hash passwords securely, making them hard to read if stolen.

2. Step 2: Identify the correct purpose in Express

   In Express apps, bcrypt is used to hash passwords before storing them in a database to protect user data.

3. Final Answer:

   To securely hash user passwords before saving them -> Option A

4. Quick Check:

   Password hashing = Secure storage [OK]

Hint: Bcrypt is for password security, not speed or formatting [OK]

Common Mistakes:

• Thinking bcrypt speeds up server
• Confusing bcrypt with session management
• Using bcrypt for data formatting

2. Which of the following is the correct way to hash a password asynchronously using bcrypt in Express?

easy

A. const hashed = bcrypt.hashSync(password, 10);

B. const hashed = bcrypt.hash(password);

C. const hashed = await bcrypt.hash(password, 10);

D. const hashed = bcrypt.compare(password, 10);

Solution

1. Step 1: Identify asynchronous bcrypt hashing syntax

   Bcrypt's async hash function requires await and two arguments: the password and salt rounds.

2. Step 2: Check each option

   const hashed = await bcrypt.hash(password, 10); uses await bcrypt.hash(password, 10); which is correct async usage. const hashed = bcrypt.hashSync(password, 10); is synchronous, C is wrong function, B misses salt rounds.

3. Final Answer:

   const hashed = await bcrypt.hash(password, 10); -> Option C

4. Quick Check:

   Async hash needs await and salt rounds [OK]

Hint: Async bcrypt hash always uses await and salt rounds [OK]

Common Mistakes:

• Using synchronous hashSync instead of async
• Calling compare instead of hash
• Omitting salt rounds argument

3. What will be the output of this code snippet?

const bcrypt = require('bcrypt');
async function test() {
  const password = 'secret123';
  const hash = await bcrypt.hash(password, 5);
  const match = await bcrypt.compare('secret123', hash);
  console.log(match);
}
test();

medium

A. Error

B. false

C. undefined

D. true

Solution

1. Step 1: Understand bcrypt.hash and bcrypt.compare

   The code hashes 'secret123' with salt rounds 5, then compares the original password to the hash.

2. Step 2: Analyze the compare result

   Since the password matches the hash, bcrypt.compare returns true, which is logged.

3. Final Answer:

   true -> Option D

4. Quick Check:

   Password matches hash = true [OK]

Hint: Compare returns true if password matches hash [OK]

Common Mistakes:

• Expecting false because of low salt rounds
• Thinking compare returns the hash
• Missing await causing undefined

4. Identify the error in this Express route using bcrypt:

app.post('/signup', async (req, res) => {
  const { password } = req.body;
  const hashed = bcrypt.hash(password, 10);
  // Save hashed password to DB
  res.send('User created');
});

medium

A. bcrypt.hash requires 3 arguments, only 2 given

B. Missing await before bcrypt.hash causing a Promise instead of hash

C. bcrypt.hashSync should be used instead of bcrypt.hash

D. Password should not be hashed before saving

Solution

1. Step 1: Check bcrypt.hash usage

   Bcrypt.hash is async and returns a Promise, so it needs await to get the hashed string.

2. Step 2: Identify missing await effect

   Without await, hashed is a Promise, not the actual hash, causing errors when saving.

3. Final Answer:

   Missing await before bcrypt.hash causing a Promise instead of hash -> Option B

4. Quick Check:

   Async bcrypt.hash needs await [OK]

Hint: Always await async bcrypt.hash to get the hash string [OK]

Common Mistakes:

• Forgetting await on async bcrypt.hash
• Using wrong number of arguments
• Thinking hashSync is mandatory

5. You want to create a secure signup route in Express that hashes the password and then verifies it immediately to confirm hashing worked. Which code snippet correctly does this?

hard

A. app.post('/signup', async (req, res) => {
const { password } = req.body;
const hash = await bcrypt.hash(password, 12);
const valid = await bcrypt.compare(password, hash);
if (valid) res.send('Signup successful');
else res.status(500).send('Hashing error');
});

B. app.post('/signup', (req, res) => {
const { password } = req.body;
const hash = bcrypt.hashSync(password, 12);
const valid = bcrypt.compareSync(password, hash);
if (valid) res.send('Signup successful');
else res.status(500).send('Hashing error');
});

C. app.post('/signup', async (req, res) => {
const { password } = req.body;
const hash = bcrypt.hash(password, 12);
const valid = bcrypt.compare(password, hash);
if (valid) res.send('Signup successful');
else res.status(500).send('Hashing error');
});

D. app.post('/signup', async (req, res) => {
const { password } = req.body;
const hash = await bcrypt.hash(password);
const valid = await bcrypt.compare(password, hash);
if (valid) res.send('Signup successful');
else res.status(500).send('Hashing error');
});

Solution

1. Step 1: Check async usage and salt rounds

   app.post('/signup', async (req, res) => { const { password } = req.body; const hash = await bcrypt.hash(password, 12); const valid = await bcrypt.compare(password, hash); if (valid) res.send('Signup successful'); else res.status(500).send('Hashing error'); }); uses async/await correctly and provides salt rounds (12) to bcrypt.hash, which is best practice.

2. Step 2: Verify immediate password check

   It compares the original password with the hash using await bcrypt.compare, then sends success if valid.

3. Step 3: Analyze other options

   app.post('/signup', (req, res) => { const { password } = req.body; const hash = bcrypt.hashSync(password, 12); const valid = bcrypt.compareSync(password, hash); if (valid) res.send('Signup successful'); else res.status(500).send('Hashing error'); }); uses sync methods which block the server, C misses await causing Promises, D misses salt rounds in hash.

4. Final Answer:

   Option A code snippet with async/await and salt rounds -> Option A

5. Quick Check:

   Async hash with salt rounds + compare = correct [OK]

Hint: Use async/await with salt rounds and compare for secure signup [OK]

Common Mistakes:

• Using synchronous bcrypt methods in async routes
• Forgetting await causing Promises
• Omitting salt rounds in hash