Concurrency issue when timing the encryption of bcrypt and creating a new document in MongoDB

Question

Concurrency issue when timing the encryption of bcrypt and creating a new document in MongoDB

My website has a register function that creates a new document with the user's credentials. Below is my implementation, where the input fields for username and password are stored in an object called data:

let users = db.collection('users');

let query = sanitize(data);

users.findOne({username: query.username}).then(res=>{
    if (res){
        socket.emit('usercreated', {
            msg: `User: ${query.username} already exists.`
        });
        return;
    }

    const h = query.username + query.password;

    bcrypt.hash(h, 13, (err, hash)=>{
        users.insert({username: query.username, password: hash}, (err, user)=>{
            if (err){
                socket.emit('usercreated', {
                    msg: `DB is having issues. Please contact admin.`
                });
                return;
            }
            socket.emit('usercreated', {
                msg: `User ${query.username} has been created.`
            });
        });
    });
})

However, a problem arises when a user spams the submit button for username and password. The 'res' variable does not recognize that the user already exists due to the asynchronous nature of the bcrypt.hash function.

I have attempted another method to check 'res' after bcrypt completes its hashing, but this approach does not solve the issue:

let users = db.collection('users');

let query = sanitize(data);

users.findOne({username: query.username}).then(res=>{
    const h = query.username + query.password;

    bcrypt.hash(h, 13, (err, hash)=>{
        if (res){
            socket.emit('usercreated', {
                msg: `User: ${query.username} already exists.`
            });
            return;
        }
        users.insert({username: query.username, password: hash}, (err, user)=>{
            if (err){
                socket.emit('usercreated', {
                    msg: `DB is having issues. Please contact admin.`
                });
                return;
            }
            socket.emit('usercreated', {
                msg: `User ${query.username} has been created.`
            });
        });
    });
})

What would be a more effective way to properly check if the user already exists before proceeding with the insertion?

javascript mongodb socket.io bcrypt

Answer 1

Answer №1

One issue arises not from the 1-second resolution time of bcrypt.hash, but rather from the way in which you are managing the process.

When dealing with spamming, the situation resembles a classic readers-writers problem. While there are numerous solutions, a straightforward adjustment of mutex locks should suffice.

class NamedLocks {
    constructor() {
        this._pid = {};
    }

    acquire(pid) {
        if (this._pid[pid]) {
            // the process is locked
            // handle it accordingly
            return Promise.reject();
        }

        this._pid[pid] = true;
        return Promise.resolve();
    }

    release(pid) {
        this._pid[pid] = false;
    }
}


let users = db.collection('users');
let query = sanitize(data);
const userLocks = new NamedLocks();

userLocks.acquire(query.username).then(() => {
    users.findOne({
        username: query.username
    }).then(res => {
        const h = query.username + query.password;

        bcrypt.hash(h, 13, (err, hash) => {
            if (res) {
                socket.emit('usercreated', {
                    msg: `User: ${query.username} already exists.`
                });
                return;
            }
            users.insert({
                username: query.username,
                password: hash
            }, (err, user) => {
                if (err) {
                    socket.emit('usercreated', {
                        msg: `DB is having issues. Please contact admin.`
                    });
                    return;
                }
                socket.emit('usercreated', {
                    msg: `User ${query.username} has been created.`
                });
                userLocks.release(query.username);
            });
        });
    })    
}).catch((e) => {
    // handle spamming
})

Answer 2

One issue arises not from the 1-second resolution time of bcrypt.hash, but rather from the way in which you are managing the process.

When dealing with spamming, the situation resembles a classic readers-writers problem. While there are numerous solutions, a straightforward adjustment of mutex locks should suffice.

class NamedLocks {
    constructor() {
        this._pid = {};
    }

    acquire(pid) {
        if (this._pid[pid]) {
            // the process is locked
            // handle it accordingly
            return Promise.reject();
        }

        this._pid[pid] = true;
        return Promise.resolve();
    }

    release(pid) {
        this._pid[pid] = false;
    }
}


let users = db.collection('users');
let query = sanitize(data);
const userLocks = new NamedLocks();

userLocks.acquire(query.username).then(() => {
    users.findOne({
        username: query.username
    }).then(res => {
        const h = query.username + query.password;

        bcrypt.hash(h, 13, (err, hash) => {
            if (res) {
                socket.emit('usercreated', {
                    msg: `User: ${query.username} already exists.`
                });
                return;
            }
            users.insert({
                username: query.username,
                password: hash
            }, (err, user) => {
                if (err) {
                    socket.emit('usercreated', {
                        msg: `DB is having issues. Please contact admin.`
                    });
                    return;
                }
                socket.emit('usercreated', {
                    msg: `User ${query.username} has been created.`
                });
                userLocks.release(query.username);
            });
        });
    })    
}).catch((e) => {
    // handle spamming
})

Answer 3

Answer №2

To prevent excessive server requests when a user repeatedly hits the submit button, consider implementing function throttling. This technique limits the function to be called only once within a specified time frame. For instance, with a timeout of 1 second, if a user rapidly clicks the button, only the first click will register, while subsequent clicks within that second will be ignored. You can utilize the _.throttle function from Underscore.js, or create your own version based on their implementation.

Answer 4

To prevent excessive server requests when a user repeatedly hits the submit button, consider implementing function throttling. This technique limits the function to be called only once within a specified time frame. For instance, with a timeout of 1 second, if a user rapidly clicks the button, only the first click will register, while subsequent clicks within that second will be ignored. You can utilize the _.throttle function from Underscore.js, or create your own version based on their implementation.

Answer 5

Answer №3

After a thorough investigation, I have the solution. It is imperative to encrypt the password first before verifying the existence of the user.

const usersList = db.collection('users');

const searchQuery = sanitize(data);
const hashedPassword = searchQuery.username + searchQuery.password;
bcrypt.hash(hashedPassword, 13, (error, hashedResult) => {
    usersList.findOne({username: searchQuery.username}).then(response => {
        if (response) {
            socket.emit('usercreated', {
                msg: `The user: ${searchQuery.username} already exists.`
            });
            return;
        }
        usersList.insert({username: searchQuery.username, password: hashedResult}, (error, userResult) => {
            if (error) {
                socket.emit('usercreated', {
                    msg: `Database is encountering issues. Please contact the administrator.`
                });
                return;
            }
            socket.emit('usercreated', {
                msg: `User ${searchQuery.username} has been successfully created.`
            });
        });
    });
});

Answer 6

After a thorough investigation, I have the solution. It is imperative to encrypt the password first before verifying the existence of the user.

const usersList = db.collection('users');

const searchQuery = sanitize(data);
const hashedPassword = searchQuery.username + searchQuery.password;
bcrypt.hash(hashedPassword, 13, (error, hashedResult) => {
    usersList.findOne({username: searchQuery.username}).then(response => {
        if (response) {
            socket.emit('usercreated', {
                msg: `The user: ${searchQuery.username} already exists.`
            });
            return;
        }
        usersList.insert({username: searchQuery.username, password: hashedResult}, (error, userResult) => {
            if (error) {
                socket.emit('usercreated', {
                    msg: `Database is encountering issues. Please contact the administrator.`
                });
                return;
            }
            socket.emit('usercreated', {
                msg: `User ${searchQuery.username} has been successfully created.`
            });
        });
    });
});

Concurrency issue when timing the encryption of bcrypt and creating a new document in MongoDB

Answer №1

Answer №2

Answer №3

Similar questions

The powerful combination of ES6 and sequelize-cli

Issue with saving documents using mongoose's save function

Using AngularJS filters to search through various fields of data

jQuery Load - Oops! There seems to be a syntax error: Unexpected token <

Monitor the console log in the Android Browser for any potential issues

Issue with Date Picker not properly storing selected date in MySQL database

AngularJS combined with MVC is causing an issue where the table fails to refresh following an HTTP post request

Issue with the iteration process while utilizing Async.waterfall in a for-loop

`No valid form submission when radio buttons used in AngularJS`

Adjust the property to be optional or required depending on the condition using a generic type

"Learn how to efficiently incorporate data into data-binding in VUE JS with just a

How can I dynamically update the status displayed in a DIV tag using PHP code?

What causes the maximum update depth exceeded error in React when trying to set data to the context?

Using Angular's built-in dependency injection with the $resource factory allows for

What is the best way to pass a dynamically generated component as the ng-content for another dynamically generated component?

I am currently in the process of conducting an automated test focused on the creation of a new Facebook account

Provide a unique <li> attribute for the JavaScript function to utilize

What is the best way to retrieve an object from every function?

Updating Object Properties in Vue.js 2.0 using Methods

Discovering the wonders of React and Javascript through the powerful Map function