Meteor - How to use use server side validation on password

问题

I'm performing server-side validation in the "Accounts.onCreateUser" function so that I can pass the options object as well. I wasn't able to figure out how to do this with the validate user function.

First, I'm totally open for correct if I'm going the wrong direction so please advise. I can't figure out how to validate password length server-side. Is it because it's already converted prior to the creation? When testing, if I enter in a single character for password it doesn't throw an error.

Accounts.onCreateUser(function (options, user) {
    if (options.profile) {
        user.profile = options.profile;
        user.profile.user_status = "new user";
    }

    // Error checking
    var errors = "";
    if (user.username.length === 0) {
        errors = errors + '<li>Email is required</li>';
    }
    if (user.username.length !== 0 && user.username.length < 4) {
        errors = errors + '<li>Email too short</li>';
    }

    if (user.profile.firstname.length === 0) {
        errors = errors + '<li>First name is required</li>';
    }

    if (user.profile.firstname.length !== 0 && user.profile.firstname.length < 2) {
        errors = errors + '<li>First name is too short</li>';
    }

    if (user.profile.lastname.length === 0) {
        errors = errors + '<li>Last name is required</li>';
    }
    if (user.profile.lastname.length !== 0 && user.profile.lastname.length < 2) {
        errors = errors + '<li>Last name is too short</li>';
    }

    if (user.services.password.length === 0) {
      errors = errors + '<li>Please enter a password</li>';
    }

    if (user.services.password.length < 7) {
      errors = errors + '<li>Password requires 7 or more characters</li>';
    }

    if (errors) {
      throw new Meteor.Error(403, errors);
    } else {
      return user;
    }

});

I'm not using Accounts-ui. Trying to roll out my own... Being completely new with Meteor it has been a bit of a battle trying to understand account creation and verification. If there's a way to do this with ValidateNewUser function should I be using that instead?

Thank you for all your help.

回答1:

I've figured out the best manner to perform this. Hope this will help others.

I'm using a method on server side to validate and returning error if there is one. Then proceeding with the Account Creation.

Meteor.call('Validate_Registration', email, password, cpassword, firstname, lastname, terms, function(error) {
            if (error) {
                error = error.reason;
                $('#Error-Block').fadeIn().children('ul').html(error);
                console.log(error);
            } else {
                Accounts.createUser({
                    username: email,
                    email: email,
                    password: password,
                    profile: {
                        firstname: firstname,
                        lastname: lastname
                    }
                }, function(error) {
                    if (error) {
                        error = error.reason;
                        $('#Error-Block').fadeIn().children('ul').html(error);
                    } else {
                        var uid = Accounts.connection.userId();
                        Meteor.call('Verify_Email', uid, email);
                        Router.go('/email-instructions');
                    }
                });
            }
        });

The only thing I'm unsure of at this point is if it's correct to use:

var uid = Accounts.connection.userId();

This seems to be local to the current user only, and is stored in local storage to the user.

回答2:

Accounts-password uses SRP, which is a bit complicated so I won't describe it fully here. The actual check of the hashed tokens happens around here Basically, the password does not arrive at the server as a plain text string therefore you will not be able to enforce password policy on the server, while using SRP.

Also notably around here there is a DDP only "plaintext" login option for those who (understandably) don't want to implement SRP on their own. As advertised, it should only be used if the user is connected w/ SSL. I would probably start there.

In the meantime, you can at least do some client side enforcing until you can roll your server-side login handler.

You may also want to check out this meteorhacks article for a custom login handler tutorial.

回答3:

According to the documentation, the password "is not sent in plain text over the wire", so the password string you're looking at on the server side is not the same as what the user typed in.

EDIT: At least, that's what I think.

EDIT2: Found a comment in another question that confirms it.

来源：https://stackoverflow.com/questions/22139108/meteor-how-to-use-use-server-side-validation-on-password

标签

javascript

meteor