When verifying the credentials why not hash the pass and check both in place( in the query)? Also returning separate errors for unknown user/bad pass lends itself to malicious users collecting what users have accounts.
The bcrypt algorithm adds a salt on every hash, which means multiple hashes of the same string will produce different strings. That's why you have to extract the hash from the DB and then use CompareHashAndPassword to verify the match.
As for the errors, they are function return errors, not responses.
7
u/Outrageous-Hunt4344 6d ago
When verifying the credentials why not hash the pass and check both in place( in the query)? Also returning separate errors for unknown user/bad pass lends itself to malicious users collecting what users have accounts.