Encryption in Meteor

问题:

I have user sign in form. It has about 10 inputs. I want to save that user, random generate password and hash and salt it and save it. How to achieve that? I couldn't find any good tutorial for using Crypto.js in meteor. I always stumble upon account-password package.

回答1:

accounts-password actually takes care of this for you. I wish the documentation of the implementation details was better, but you can see an overview here.

Passwords are verified by examining hashes, so only a hashed version of the passed from the client to the server which is then run through bcrypt.

client: password --> network: sha256(password) --> server: bcrypt(sha256(password))

What's nice about this implementation is: (a) the server never sees or stores password-equivalent data, (b) it's all done for you just by installing the package.

Also see this hackpad for more details.