Security risks sending password from a client component to a server action
Answered
Balinese posted this in #help-forum
BalineseOP
I'm a relatively new dev working on the sign up feature for a production app and am trying to move the user setup (authentication, user data to database) into a server action. I created a server action that takes in the form data and uses it to create a user auth account and add user data to the DB using the Firebase Admin SDK.
Since the password (as a string) is part of the form data, should I be hashing it before sending it to the server action?
On the client form upon hitting submit button:
On the server action:
Since the password (as a string) is part of the form data, should I be hashing it before sending it to the server action?
On the client form upon hitting submit button:
await SetUpUser(userData) // Server action to create user auth and data in database
await signIn(userData.email, userData.password) // Sign in clientOn the server action:
const userRecord = await auth.createUser({
email:userData.email,
password:userData.password,
})
const userRef = firestore.collection('users').doc(userRecord.uid)
await userRef.set({
firstname: userData.firstname,
lastname: userData.lastname,
company: userData.company,
email: userData.email,
created: Firestore.FieldValue.serverTimestamp(),
})Answered by B33fb0n3
as far as I know you don't need to hash it. Even if you would use a route handler, you send the password as plain text as post request to it. And post requests are secure. If you safe the password in your database, then you should hash it. I am not familiar with firebase, but I think they do that automatically. You should check that ðŸ‘
@Balinese
@Balinese
7 Replies
as far as I know you don't need to hash it. Even if you would use a route handler, you send the password as plain text as post request to it. And post requests are secure. If you safe the password in your database, then you should hash it. I am not familiar with firebase, but I think they do that automatically. You should check that ðŸ‘
@Balinese
@Balinese
Answer
@B33fb0n3 as far as I know you don't need to hash it. Even if you would use a route handler, you send the password as plain text as post request to it. And post requests are secure. If you safe the password in your database, then you should hash it. I am not familiar with firebase, but I think they do that automatically. You should check that ðŸ‘
<@161658285647331330>
BalineseOP
Thanks for the quick reply! Firebase does hash the password, I was just concerned about the trip from the client to the node server.
oh ok got it. Yea as I said 🙂
please mark solution
BalineseOP
how do I do that