Hash passwords client-side before they go over the wire.

Differential · Jul 7, 2014 · f53c7c8 · timbrandin · Oct 2, 2014 · f53c7c8
1 parent 0ffa30a
commit f53c7c8
Show file tree

Hide file tree

Showing 2 changed files with 8 additions and 2 deletions.
diff --git a/client/views/signUp/signUp.coffee b/client/views/signUp/signUp.coffee
@@ -1,3 +1,7 @@
+AccountsEntry.hashPassword = (password) ->
+  digest: SHA256(password),
+  algorithm: "sha-256"
+
 AccountsEntry.entrySignUpHelpers = {
   showEmail: ->
     fields = AccountsEntry.settings.passwordSignupFields
@@ -131,7 +135,7 @@ AccountsEntry.entrySignUpEvents = {
         newUserData =
           username: username
           email: email
-          password: password
+          password: AccountsEntry.hashPassword(password)
           profile: filteredExtraFields
         Meteor.call 'entryCreateUser', newUserData, (err, data) ->
           if err

diff --git a/package.js b/package.js
@@ -15,7 +15,8 @@ Package.on_use(function(api) {
     'session',
     'coffeescript',
     'simple-form',
-    'less']
+    'less',
+    'sha']
   , 'client');
 
 
@@ -67,6 +68,7 @@ Package.on_use(function(api) {
 
   // CLIENT and SERVER
   api.imply('accounts-base', ['client', 'server']);
+  api.imply('accounts-password', ['client', 'server']);
   api.export('AccountsEntry', ['client', 'server']);
   api.use('iron-router', ['client', 'server']);
   api.use(['accounts-t9n'], ['client', 'server']);