node.js - crypotjs - 使用 findOne() 解密值

Question

我已经加密了一个 URL 值并将其存储在 MongoDB 中。我不明白的是，如果它是加密的，findOne 将如何找到 URL。我不认为我可以使用 generatedUrl 再次加密，并且值将匹配。也许有比加密更好的方法？

在这里加密

app.post("/api/users/passwordurl", function(req, res) {

  crypto.randomBytes(16, (err, buf) => {});

  let iv = crypto.randomBytes(16);

  let hash = crypto
    .createHash("sha256")
    .update(req.body.url)
    .digest("hex");

  let secret_message = req.body.url;
  let key = "12345678123456781234567812345678";

  let cipher = crypto.createCipheriv("aes-256-cbc", key, iv);
  let encrypted = cipher.update(secret_message, "utf-8", "hex");
  encrypted += cipher.final("hex");
  console.log("encrypted: " + encrypted);



  const url = new Url({
    url: encrypted,
    used: false
  });

  //saves to database with mongoose
  url.save().then(result => {
    res.status(201).json({
      message: "URL success",
      postId: result._id
    });
  });
});

这里需要解密

app.get("/resetpassword/:id/:token", function(req, res) {


  User.findById(req.params.id).then(user => {
    if (!user) {
      return res.status(401).json({
        message: "Auth failed"
      });
    }

    var secret = user.password + "-" + user.passwordCreated.getTime();
    var payload = jwt.decode(req.params.token, secret);

    console.log("USER FOUND: ", user);

    let generatedUrl = `http://localhost:3000/resetpassword/${payload.id}/${req.params.token}`;

    Url.findOne({ url: generatedUrl }).then(url => {

      if (!url) {
        res.send("link has expired");
        res.end();
      } else {
        res.send(
          '<form action="/resetpassword" method="POST">' +
            '<input type="hidden" name="id" value="' +
            payload.id +
            '" />' +
            '<input type="hidden" name="token" value="' +
            req.params.token +
            '" />' +
            '<input type="password" name="password" value="" placeholder="Enter your new password..." />' +
            '<input type="submit" value="Reset Password" />' +
            "</form>"
        );
      }
    });
  });
});

标签： node.jsexpressencryptionmongoosecryptojs