2 replies

Password Handling

I have a simple site with an input for a password and then on submit, it goes to this:

import { NextResponse } from "next/server";

export async function POST(request: Request) {
  const { password } = await request.json();

  // Replace with your secure password check.
  if (password === process.env.PASSWORD) {
    const response = NextResponse.json({ success: true });

    // Set a cookie called "authenticated". In production, you may
    // want to sign or encrypt cookies.
    response.cookies.set("authenticated", "true", {
      httpOnly: true,
      path: "/",
      maxAge: 5 * 60 * 24, // 24 hours
    });

    return response;
  }

  return NextResponse.json({ success: false }, { status: 401 });
}

import { NextResponse } from "next/server";

export async function POST(request: Request) {
  const { password } = await request.json();

  // Replace with your secure password check.
  if (password === process.env.PASSWORD) {
    const response = NextResponse.json({ success: true });

    // Set a cookie called "authenticated". In production, you may
    // want to sign or encrypt cookies.
    response.cookies.set("authenticated", "true", {
      httpOnly: true,
      path: "/",
      maxAge: 5 * 60 * 24, // 24 hours
    });

    return response;
  }

  return NextResponse.json({ success: false }, { status: 401 });
}

o3 wrote some comments here and suggested a "secure password check" as well as signing or encrypting cookies. What I want to understand is that, why would I need to do a "secure password check" if my password is stored in a .env that is only on my server? ~~Also do I really need to sign or encrypt my cookies, what are some things that could go wrong if I don't?~~ I just opened dev tools and manually set it and that bypasses the password lol, I'll have to look into how to do this after all lol

For secure password check, I'm assuming just hashing the password and then check the input password's hash against it, is that good enough? I never did something like this before and so I'm unsure what "best practices" would be for this.

Password Handling

I have a simple site with an input for a password and then on submit, it goes to this:

import { NextResponse } from "next/server";

export async function POST(request: Request) {
  const { password } = await request.json();

  // Replace with your secure password check.
  if (password === process.env.PASSWORD) {
    const response = NextResponse.json({ success: true });

    // Set a cookie called "authenticated". In production, you may
    // want to sign or encrypt cookies.
    response.cookies.set("authenticated", "true", {
      httpOnly: true,
      path: "/",
      maxAge: 5 * 60 * 24, // 24 hours
    });

    return response;
  }

  return NextResponse.json({ success: false }, { status: 401 });
}

import { NextResponse } from "next/server";

export async function POST(request: Request) {
  const { password } = await request.json();

  // Replace with your secure password check.
  if (password === process.env.PASSWORD) {
    const response = NextResponse.json({ success: true });

    // Set a cookie called "authenticated". In production, you may
    // want to sign or encrypt cookies.
    response.cookies.set("authenticated", "true", {
      httpOnly: true,
      path: "/",
      maxAge: 5 * 60 * 24, // 24 hours
    });

    return response;
  }

  return NextResponse.json({ success: false }, { status: 401 });
}

Password Handling

Similar Threads

Password Handling

Similar Threads

Similar Threads

Similar Threads