Here's the challenge we have.
We want to encrypt the user's password before saving into the database.
And this is very important so that if somebody hacks into our database, the person won't be able to
identify the user's password.
So we are going to use mongoose model hooks to be able to do this.
What is a hook?
It's just like a middleware.
I'm going to show you.
We'll go to our model, which is the user JS And we're going to say user schema dot pre.
And this pre takes in the name of the hook.
And the one we are interested in right now is save.
And we are saying Mongoose.
Before you actually save any record into the user schema or into the user collection in the database,
execute the function that we are going to pass in right here.
Okay.
So this is just like a middleware.
So it receives a function called next.
And basically we are saying Mongoose, before you save any record into the database, just like we are
doing in our controller right here with the user dot create function, execute this function in our
middleware.
Okay, so this is the function we are passing in right here.
And remember, for us to tell Mongoose that we are done doing what we want to do, we are going to call
the next function just like in Express middleware.
The first thing we have to do is actually install a package called Bcrypt.
And this package is the package that's going to be in charge of encrypting our password before storing
into the database.
Done.
Let's import that package right here.
So at the top, I'm going to say constants Bcrypt is going to be equal to require and would require
in the bcrypt package we just installed.
The next thing for us to do is actually get the user that is being saved.
Now Mongoose is going to make the user available to us in a variable called this.
And this is basically referring to this class right here.
Okay.
So in other words, the user that is being saved, right?
Then we are going to say bcrypt dot hash.
And the hash is a function that takes in what we want to hash.
So we want to hash the user dot password.
And the next thing is the number of rounds.
So think of the hashing algorithm as an encryptor so it can encrypt a word over ten times, which makes
it more secure.
It can also encrypt a word 100 times, which makes it 100 times secure.
And the higher the number of rounds, then the higher or the the more secure the encryption, but the
higher the number of rounds, the slower the process.
So we are also going to just put in ten, which is not very much, and it's just okay.
Okay.
So that's the number of times we want the encryption process to go on.
Then the final argument is a function that is going to be executed once the encryption is done.
Once the encryption is done, we are going to receive an error here in case there was an error and we
are also going to receive the encrypted password.
Okay.
So we are going to say once this is done, user password should no longer be the string that it was.
It should now be the encrypted version.
And finally, we are going to call next.
Okay, so this is our pre save hook.
So before saving any record, get the user encrypt the user's password, set the user's password to
be the encrypted version.
And finally call next so that mongoose can continue creating the user data.
So let's try this out.
If everything works correctly, we should actually see an encrypted password in the database.
So we'll go to our application.
Then we're going to come to register.
And here I'm going to pass in name, email and password.
And click on Register now.
All right.
So now that that's done, let's go back to our mongoose and refresh our collection.
And if you check out the second object right now, you can see that we have a name, we have an email
and we have a password that is hashed.
Look at that.
So we can't identify what password the user typed in.
And that is very important for security purposes.
So Mongoose gives us the possibility of changing the data before actually saving it into the database.