{"id":22579380,"url":"https://github.com/snenenenenenene/software-security-auth-proj","last_synced_at":"2025-03-28T16:21:38.400Z","repository":{"id":93825325,"uuid":"344468263","full_name":"snenenenenenene/software-security-auth-proj","owner":"snenenenenenene","description":null,"archived":false,"fork":false,"pushed_at":"2021-04-01T09:48:38.000Z","size":276,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":2,"default_branch":"main","last_synced_at":"2025-02-02T16:42:11.059Z","etag":null,"topics":["authentication","login","project"],"latest_commit_sha":null,"homepage":null,"language":"JavaScript","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/snenenenenenene.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2021-03-04T12:33:39.000Z","updated_at":"2023-01-02T12:22:36.000Z","dependencies_parsed_at":null,"dependency_job_id":"f94d91c2-f5f2-4de7-b62f-d8db245812a2","html_url":"https://github.com/snenenenenenene/software-security-auth-proj","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/snenenenenenene%2Fsoftware-security-auth-proj","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/snenenenenenene%2Fsoftware-security-auth-proj/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/snenenenenenene%2Fsoftware-security-auth-proj/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/snenenenenenene%2Fsoftware-security-auth-proj/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/snenenenenenene","download_url":"https://codeload.github.com/snenenenenenene/software-security-auth-proj/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":246059298,"owners_count":20717085,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["authentication","login","project"],"created_at":"2024-12-08T05:07:20.587Z","updated_at":"2025-03-28T16:21:38.382Z","avatar_url":"https://github.com/snenenenenenene.png","language":"JavaScript","funding_links":[],"categories":[],"sub_categories":[],"readme":"# SoftwareSecurity\n\n### sourcecode: https://github.com/snenne/SoftwareSecurity\n### url of hosted website: https://softwaresecurity-app.herokuapp.com/\n\n## SUMMARY\n\nThis is the final project for the course Software Security.\nFor said course we had to create a web application that introduces a self-made authentic login and registering mechanism.\nThe registering mechanism disables users to check in with a vulnerable password by chcking the **HIBP** (Have I been Pwned) API. \n\nAfter a user has been registered, aforementioned user will be able to use his credentials to log in to the web application.\nAfter doing so, the user will be greeted by the homepage of the website wich is frankly quite lackluster, but it was not part of the requirements nor the scope of our project.\n\n## TOOLS + WHY\n\n### PasswordValidator \n{https://stackoverflow.com/questions/34760548/how-to-validate-password-using-express-validator-npm}\n\nWe could've used some form of regex validation instead of this package but since this fit our requirements perfectly and because of its modularity we ended up going with this npm package to validate the integrity of new passwords. \n\n```js\nvar schema = new passwordValidator();\n\nschema\n.is().min(8)\n.is().max(100)\n.has().uppercase()\n.has().lowercase()\n.has().digits(2)\n.has().not().spaces()\n```\n\n### JS-Sha1\n\nTo protect user credentials the HIPB API only allows for the first 5 sha-encrypted characters of a password to be used in order to check whether said password has been \"PWNED\". Hence we installed and used an npm package which - in a self-explanatory manner - is named js-sha-1. \n\n```js\nvar sha = sha1(password).toUpperCase();\nvar prefix = sha.substring(0, 5);\nvar suffix = sha.substring(5, sha.length);   \n```\n\n### Axios\n\nIn succession to the aforementioned password validation and sha-encryption we have actually check in with the HIBP API. We do this by sending a GET-request - through an npm package that goes by the name axios - to said API and appending the output of the sha-function to the API url: {https://api.pwnedpasswords.com/range/{sha-password}.\n\n```js\naxios({\n        method: 'get',\n        url: 'https://api.pwnedpasswords.com/range/' + prefix,\n    })\n    .then(response =\u003e {\n      //response code\n    }\n```\n### Bcrypt\n\nTo encrypt, salt and decrypt the plaintext passwords and passwords stored in the database respectively we opted for the popular yet secure npm package bcrypt.\nFrom what it seemed it looked like bcrypt is a big player in the hashing/salting scene and since it fit in perfectly with the scope of this project we did not hesitate to tie this package in with the rest of our application.\n\n\n## ROADMAP\n\nWe first started by the HIBP section of the backend since that seemed to be the most confronting part of this whole exercise. \nSince this was in the mere beginning of the exercise we implemented it by using jquery's ajax function. However, when our project started growing in size and complexity due to the addition of a connection between the back- and frontend in order to check and test actual passwords we decided that it'd be better if we switched to an express app since that's what we've been familiarised with.\nAfter refactoring the code a couple of times we started writing the routes for our authorisation function.\nThen we had to create a connection with a mysql database in order to GET and POST the users. After lots of trial and error we added a seperate ./lib/db.js file that uses the homonymous npm package.\nWhen this was done we needed to look for a host for both our database and website. \nWe ended up using freesqldbhosting.com and heroku respectively.\n\n## DIFFICULTIES\n\nOne of the main difficulties was doing this whole operation without having an analysis document to hold on to.\nAs well as hosting a database. Since we didn't want to taint our AWS accounts that we were using for a different subject (ICT-Architecture) and since we couldn't extensively test Azure due to its price we ended up having to look for a different and quite frankly sketchier database hosting website. In an actual production environment we would obviously never do this but due to not having the means necessary we had to look elsewhere.\n\n## REFERENCES\n\nhttps://stackoverflow.com/questions/34760548/how-to-validate-password-using-express-validator-npm\n\nhttps://ourcodeworld.com/articles/read/258/how-to-connect-to-a-mysql-database-with-node-js\n\nhttps://haveibeenpwned.com/API/v2\n\n## CONCLUSION\n\nThis project has helped us understand authentication by having us utilise a hands-on approach. By using the theory seen in class it became clear what all the different concepts and notions really meant in a pragmatic sense. \n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsnenenenenenene%2Fsoftware-security-auth-proj","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fsnenenenenenene%2Fsoftware-security-auth-proj","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsnenenenenenene%2Fsoftware-security-auth-proj/lists"}