bcrypt.compare return false always.

[edgarcheverier]

node v: v10.13.0
"bcrypt": "^3.0.2"

I console log the passwords and the hash to check if I was doing something wrong, also tried to create the hash with '${req.body.password}' but nothings seems to be working.
thanks !

the bcrypt.compare returns false always, when tries to compare hash from the db with the string password.

router.post('/', function (req, res) {
  bcrypt.hash(req.body.password, saltRounds, function(err, hash) {
    client.query(
      `INSERT INTO public."user"(name, last_name, email, password,  phone, photo)
      VALUES($1, $2, $3, $4, $5, $6)`,
    [req.body.name,
      req.body.last_name,
      req.body.email,
      hash,
      req.body.phone,
      req.body.photo])
  })
})

router.post('/login', function(req, res) {
  client.query(
    `SELECT email, password FROM public."user" WHERE email = '${req.body.email}'`,
    function(err, res) {
      if (err) {
        console.log(err)
      } else {
        bcrypt.compare(req.body.password, res.rows[0].password).then(function(res) {
          console.log(res)
        })
      }
    })
})

[recrsn]

Character encoding? Could that be an issue?

[edgarcheverier]

Thank you for the response, the problem seems to be related to the amount of characters, the length must be 60 in order to work.

[SaqrWare]

i've the same issue with v10.13.0, on v8 works like normal

[heavyrick]

and how can we resolve that? 61 it's not a pattern ?

when we use the bcrypt-generator it generates the sameu number

[joshuaanthonydeleon]

This seems to be a continuing issue are there any updates to specific issue?

[recrsn]

In all cases the issue has been with the user input, character encoding, or supplying invalid hashes.

We do not throw an error for a malformed bcrypt hash. This is something what I think we should be revisiting.

[nachiket-sazinga]

My Character length is 255 in DB, Also before data stored in DB it returns true but at the time of checking again after store (i..e. value from DB) it returns false I checked both strings plain and hash from both sides (i.e. from request and from DB)

[ybelenko]

Solved to me with the hack from #849 (comment)
Need to replace $2y$ with $2a$ manually:

const hashPass = /^\$2y\$/.test(user.password) ? '$2a$' + user.password.slice(4) : user.password;