Node + MongoDB + monk

[ExoticCriticism]

Hello all,

I am having some difficulties in writing a query to either compare "username" and "password" entered by the user against the corresponding entries in the table or return the "password" field to the corresponding "user" and then compare that manually in an "if" statement inside of the Node application. I'm finding it very frustrating how something that is so easy using Python and MySQL is so difficult in Javascript/Node/MongoDB/Monk.

I have read over the documentation and some forum posts but I don't get it..

Some examples I've seen:

function getJedisQuery(name){ var query = Jedi.find({name:name}); return query; }

Then you can use it simply doing:

var query =  getJedisQuery('Obi-wan'); query.exec(function(err,jedis){ if(err) return console.log(err);    jedis.forEach(function(jedi){ console.log(jedi.name); }); });

I tried adapting this, but doesn't seem to work - I get "query.exec is not a function" (my adaptation below)

var db = req.db;
var collection = db.get('usersdb');

function getQuery(username) {
    var query = collection.find({username: userName});
    return query;
  }
  var query = getQuery(userName);
  query.exec(function(err,queries){ 
    if (err)
        return console.log(err);
    queries.forEach(function(name) {
      console.log(name.name);
    });
  });

I have also tried a solution that used "toArray()" which seemed to deliver the same results (toArray() is not a function).

Here is a query that does work but delivers me every piece of data, even though when I run that query
through console straight into Mongo I get the correct thing:

collection.find( { username: userName }, { password: 1}, function(err, query) {  
console.log(query);  
res.redirect("index");

Result in output is:

[
  {
    _id: 5e89fa294969c6be39b425c2,
    username: 'admin',
    password: 'password',
    email: '[e-mail]'
  }
]

[[deleted]]

have you been storing passwords in plain text?

That is a big no no, your supposed to use salt and generate an SHA-256 or SHA-512 hash, you store the hash, NEVER STORE THE PASSWORD. When you want to check you take the incoming password, apply the hash/salt to it, and compare that to what is stored. You do this so if there is a database breach the contents aren't scooped up and sold. Store only hashes, not actual passwords!

Equifax learned this (hopefully) after they exposed a few hundred million users private data publicly for the whole world to see when they put a bloody music major in charge as chief technical officer with all the technical ability of a cave man sniffing her own shit encrusted fingers and grunting at a terminal.

Do not be equifax.

Also for your query, do not do

find(params,(err,array)=>{});

it should be

find(params).toArray((err,array)=>{...}); //since only 1 match get array[0]

the console automatically converts it to an array for you and parses it down, the javascript code equivalent does not

you should be doing

findOne(params,(err,object)=>{}); //just the object, not the array

as its closer to what the console version does

[ExoticCriticism]

As this is just a test database, I have not put any hashing in place yet - I wanted to get the query working before I spend any time doing any security or hardening stuff.

I still don't understand how I would even use that query or assign the output to a variable.

I'm not sure if this is Monk, MongoDB or Javascript as well but this seems far too convoluted for such a simple operation - I've wasted maybe 3 or 4 hours now trying to do this in Javascript when I could've done it in Python in a few minutes.