salt password

Caillouo · Sep 30, 2024 · 05532b8 · 05532b8
1 parent 6780023
commit 05532b8
Show file tree

Hide file tree

Showing 3 changed files with 31 additions and 11 deletions.
diff --git a/threejs/database.js b/threejs/database.js
@@ -37,32 +37,45 @@ export async function getUser(username) {
     }
 }
 
-export function addUser(username, password) {
+export function addUser(username, password, salt) {
     const newUserRef = ref(db, `users/${username}`);
     set(newUserRef, {
         username: username,
         highScore: 0,
         password: password,
+        salt: salt
     })
         .catch((error) => {
             console.error("Error adding user: ", error);
         });
 }
 
-export async function logUser(username, password = localStorage.getItem("password")) {
+export async function logUser(username, password = null) {
+    var hashObj = new jsSHA("SHA-512", "TEXT", { numRounds: 1 });
     const userRef = ref(db, `users/${username}`);
     const user = await getUser(username);
+    let hashedPassword, salt = null;
     if (user === null) {
-        addUser(username, password);
+        salt = generateSalt();
+        hashObj.update(password + salt);
+        hashedPassword = hashObj.getHash("HEX");
+        addUser(username, hashedPassword, salt);
         loggedUser = await getUser(username);
     } else {
-        if (user.password !== password) {
+        salt = user.salt;
+        hashObj.update(password + salt);
+        hashedPassword = hashObj.getHash("HEX");
+        if (localStorage.getItem("hashedPassword") !== null) {
+            hashedPassword = localStorage.getItem("hashedPassword");
+        }
+        if (user.password !== hashedPassword) {
             return null;
         }
         loggedUser = user;
     }
 
     localStorage.setItem("username", username);
+    localStorage.setItem('hashedPassword', hashedPassword);
     return loggedUser;
 }
 
@@ -93,4 +106,13 @@ export async function getHighScores() {
         console.error("Error getting high scores: ", error);
         return null; // Renvoie null en cas d'erreur
     }
+}
+
+function generateSalt() {
+    var salt = "";
+    var characters = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789";
+    for (var i = 0; i < 16; i++) {
+        salt += characters.charAt(Math.floor(Math.random() * characters.length));
+    }
+    return salt;
 }
diff --git a/threejs/jeu.js b/threejs/jeu.js
@@ -263,7 +263,9 @@ function manger() {
     score++;
     document.getElementById('scoreValue').innerText = score;
 
-    setHighScore();
+    if (loggedUser) {
+        setHighScore();
+    }
 }
 
 function animate() {

diff --git a/threejs/snake.html b/threejs/snake.html
@@ -214,7 +214,7 @@ <h5 class="modal-title" id="userLoginModalLabel">Connexion pour sauvegarder votr
     if (localStorage.getItem('username') === null) {
         userLoginModal.show();
     } else {
-        await logUser(localStorage.getItem('username'), localStorage.getItem('password'));
+        await logUser(localStorage.getItem('username'));
         if (loggedUser == null) {
             userLoginModal.show();
         } else {
@@ -228,16 +228,12 @@ <h5 class="modal-title" id="userLoginModalLabel">Connexion pour sauvegarder votr
         event.preventDefault();
         let username = document.getElementById('username').value;
         let password = document.getElementById('password').value;
-        var hashObj = new jsSHA("SHA-512", "TEXT", { numRounds: 1 });
-        hashObj.update(password);
-        let hashedPassword = hashObj.getHash("HEX");
         if (username != '') {
-            await logUser(username, hashedPassword);
+            await logUser(username, password);
             if (loggedUser == null) {
                 document.getElementById('errorLogin').style.display = 'block';
                 return;
             }
-            localStorage.setItem('password', hashedPassword);
             document.getElementById('errorLogin').style.display = 'none';
             document.getElementById('loggedUsername').innerText = loggedUser.username;
             document.getElementById('highscore').innerText = loggedUser.highScore || 0;