05 · การยืนยันตัวตน (Authentication)

# Gemfile: gem "bcrypt"
class User < ApplicationRecord
  has_secure_password                       # bcrypt hash in password_digest
  validates :password, length: { minimum: 12 }, allow_nil: true   # you add this
end

User.create!(email_address: "ana@x.test", password: "correct horse battery staple")
user.authenticate("typed password")         # => user, or false

// npm install bcrypt   (or argon2)
const bcrypt = require("bcrypt");

// sign-up: store only the hash (salt is embedded in it)
const hash = await bcrypt.hash(password, 12);   // 12 = cost factor
await db.users.insert({ email, password_hash: hash });

// login
const ok = await bcrypt.compare(typedPassword, user.password_hash);

# pip install argon2-cffi   (Django: make_password / check_password do this for you)
from argon2 import PasswordHasher
from argon2.exceptions import VerifyMismatchError
ph = PasswordHasher()

# sign-up: store only the hash (salt is embedded in it)
user.password_hash = ph.hash(password)

# login
try:
    ph.verify(user.password_hash, typed_password)
except VerifyMismatchError:
    deny()

class SessionsController < ApplicationController
  rate_limit to: 10, within: 3.minutes, only: :create   # Rails 7.2+

  def create
    # authenticate_by hashes even when the email is unknown (timing-safe)
    if user = User.authenticate_by(params.permit(:email_address, :password))
      start_new_session_for user            # generator helper: fresh Session record
      redirect_to after_authentication_url
    else
      redirect_to new_session_path, alert: "Try another email address or password."
    end
  end
end

app.post("/login", async (req, res) => {
  const user = await db.users.findOne({ email: req.body.email });
  // compare against a dummy hash when the user doesn't exist,
  // so both paths take the same time
  const hash = user ? user.password_hash : DUMMY_BCRYPT_HASH;
  const ok = await bcrypt.compare(req.body.password, hash);
  if (!user || !ok) return res.status(401).render("login",
      { error: "Invalid email or password." });       // one message
  await startNewSession(req, user);                   // see section 06
  res.redirect("/");
});

@app.post("/login")
def login():
    user = User.query.filter_by(email=request.form["email"]).first()
    # verify against a dummy hash when the user doesn't exist,
    # so both paths take the same time
    stored = user.password_hash if user else DUMMY_HASH
    ok = verify(stored, request.form["password"])
    if not user or not ok:
        return render_template("login.html",
            error="Invalid email or password."), 401   # one message
    start_new_session(user)                             # see section 06
    return redirect("/")