jeongtaebang / transfermarkt Goto Github PK

So in our backend, the way we authenticate login is using the function

bcrypt.compare(user_given_plaintext_pw, hash_pw, function(err, result) {
    // result == true: return token
    // else                : wrong creds
});

I have been trying to authenticate with postman but I think there is an issue between the backend and the script that populates the managers table.

I really don't suspect the bcrypt algorithm is different. So I want to focus on

    # Keep Plaintext password so we can write to a record (will drop before placing into DB)
    manager['Password'] = passwords[i]
    bytes_password = passwords[i].encode()
    
    # decode and remove first 2 chars is to convert from bytes literal to UTF-8 string
    # and remove python bcrypt's prefix
    manager['SaltedPassword'] = bcrypt.hashpw(bytes_password, bcrypt.gensalt(rounds=12)).decode()[7:]

There could be some issue with how we:

• encode()
• decode()
• slciing [7:]

There can be different issues related to utf-8 or things like that involved in encode/decode.
Here is node bcrypt hash_pw that I generated for "chloeozzy" "walk51song", with rounds=12
$2b$12$8ej3OWvZDsWGib2Tf22js.oNK/60PHXR6jiPzw2JrwhWGZrSzgvAm.

The node bcrypt module doesn't have much flexibility in how the password hash is generated.
Let me know if you can tweak the python script to have the hash match the above.
For node bcrypt, look here