Hashing Passwords

[00:00:00]
>> Let's actually start fixing our RegisterUser function. I'm gonna do that in our types.go. So there's one big, glaring issue, and that's we are storing plaintext passwords. That's not good, we don't want that. So how can we change this? If you go back, let's make a new type called User.

[00:00:17]
And it's gonna be a struct, and it's gonna look very similar. We're gonna have a Username field, Username string. It's gonna be a string, it's gonna have the same json: "username", okay? But this time, instead of just plaintext password, which we get from the request, we're gonna have Passworhash, still gonna be a string, okay?

[00:00:35]
And it's gonna be json, and it's gonna be password, and it should be password. Yeah, I don't think we need to change that, yeah, cool. Okay, so this new type looks exactly the same, password, not harsh. Let's change this, I think I'm typing too fast, PasswordHash, cool, okay?

[00:00:57]
And so where this user is gonna come into play is once we know there's no existing users, once we have confidence that there's no errors, before we insert user, we're not gonna be inserting of type RegisterUser, we're gonna be inserting of type User, okay? We're gonna do func NewUser, it's gonna take a registerUser of type RegisterUser.

[00:01:18]
And what it's going to return is a User and an error, okay? And why is that? Why am I doing all this work? Because this is where we're gonna create the hashedPassword function. Now, I would be an absolute fool if I were to stand in front of you and say, we're gonna make this our own.

[00:01:36]
I will never ever say I know enough about security to a level where I think I can hash my own password. That's why we're gonna use packages, it's gonna make our lives a little easier. So make sure you cd into your lambda, clear this. I'm gonna do go get, and the package we're gonna use is gonna be called bcrypt.

[00:01:55]
golang.org, so it's not Github, okay, x/crypto/bcrypt. Make sure I got that right, golang.org/x/crypto and bcrypt, sweet. Now, we got it. bcrypt is gonna do the heavy lifting for us, okay? You do not wanna be responsible for hashing passwords, I do not recommend that, but it's not financial advice.

[00:02:23]
Go here, we import that same thing, golang.org/x/crypto/bcrypt, cool. Imported and not used, that's the best message here. And then here, we're gonna do hashedPassword, and then it also returns an error. It's going to be bcrypt, and we're gonna do, not compare and hash. We're gonna use that afterwards, but we're gonna do GenerateFromPassword.

[00:02:50]
And this GenerateFromPassword takes a slice of bytes, which is another underlying data structure and essential type to Go. That's how a lot of the conversion between strings, different parameters are processed with functions within Go for performance reasons, efficiency reasons, and just natively being able to be more flexible with that implementation.

[00:03:11]
So here, how do we get a byte? How do we transform a string from a byte? We can just easily transform that with something like this. So first, it's gonna expect a slice of bytes, and it can transform the registerUser.Password. And this conversion transforms that string representation into a slice of bytes for us.

[00:03:35]
Okay, and the next parameter is this hashing algorithm, the salt, I think, if you will, we're gonna go with 10. The higher you go, the more it's going to take, processing-wise, to salt your password, to hash it correctly. But again, the higher you go, the more secure it is, but the longer it takes to create it.

[00:03:57]
10 is a good value, where we have a good security into the hashing, and it's not gonna take too long to generate, okay? And now if the error does not equal to nil, what I'm gonna do is return an empty User type, doesn't really matter. And I'm actually gonna talk about something.

[00:04:20]
So we can easily do something here. Remember how we were asked, when do we use this versus not? Well, this is an example of when you could just do nil, right? Cuz this zero value of a point of reference is nil. So there's applications where this matters, there's some applications where maybe it doesn't matter as much.

[00:04:40]
For our case, because I know I'm gonna be calling this NewUser, and where I'm calling it, I'm just gonna be checking on the error. I really don't care what this value is here, if it's nil or an empty User type. If I get an error, that's the only thing I'm focusing on in that block of code, okay?

[00:05:03]
Okay, and so now, once we have the password, all we're gonna do is return an instance of User, but this one's not gonna be empty. So our username is going to be from registerUser.Username. And then the password, PasswordHash, is gonna be the string. Cuz remember, this returns a byte, a slice of bytes generated from password, this bcrypt library.

[00:05:25]
So we have to do string, and we're gonna put in the hashedPassword, okay? And it's complaining, because we don't have enough return types, so it's gonna return User and nil. Cool, while we're here, it's interesting to kinda think about this from when you implement it versus when it's working, okay, wait.

[00:05:57]
Right now, if we look at our database, the passwords are plaintext passwords. Okay, but if we kinda think forward a little bit, once we use this NewUser function, every time we call that register function, invoke it, I should say, it's gonna be the username and the hash representation of that password.

[00:06:16]
And that's great, but then it's like, well, when we log in, which is something we're gonna build here, what do you do? Cuz no one is ever gonna have that hashed representation of your password, certainly not your client, right? So how do we go from the plaintext password to the hashed password?

[00:06:35]
And we could do it later on, I'm gonna do it right now just so we have it in our back pocket. But the function is gonna be just a ValidatePassword function, okay? This ValidatePassword function is gonna take two arguments, it's gonna be a hashedPassword. So this hashedPassword is gonna come from our database, that's the only place it's actually gonna come.

[00:06:54]
And then it's gonna be also plainTextPassword. plainTextPassword comes from a request from our clients. And this little short form notation, hashedPassword, if you note, they're both can be strings, you can just append string at the end. So instead of doing hashedPassword string, plainPassword string, you can just do both, and then string at the end, okay?

[00:07:18]
And the only thing that it's gonna return is a Boolean, true or false, only thing we care about. Here, I'm gonna declare an error. I'm gonna say, basically, we need bcrypt.CompareHashAndPassword. Be very careful here about the direction you put your arguments, cuz it does matter. The first argument has to be the hashed representation.

[00:07:39]
The second argument can be the plaintext password. And similar thing, we're gonna pass in a list of bytes. We're gonna transform our hashedPassword. List of bytes, it's gonna be the plainTextPassword, okay? And what we're gonna do is return error if our error basically equals nil, okay? So this is gonna be a truthy or falsey.

[00:08:07]
It's gonna basically return, do you have an error, yes, return True. I mean, if there's an error, return False, if there's no error, return True. Which is why we have that Boolean return in the ValidatePassword function. So we're not really doing too much of hashing, we're kind of leaving that up to a much smarter package that we're depending on, but we're still using it in our application code, okay?