Hashing

Introduction

Password hashing in JCC Express MVC uses bcryptjs through utility helpers:

• bcrypt(plainText) -> create hash
• verifyHash(plainText, hash) -> compare plaintext to hash

Both are exported from jcc-express-mvc and available as global helpers (bcrypt(), verifyHash()).

Hash a password

import { bcrypt } from "jcc-express-mvc";

const hash = await bcrypt("my-plain-password");

Implementation uses:

• bcryptjs.genSalt(10)
• bcryptjs.hash(...)

Verify a password

import { verifyHash } from "jcc-express-mvc";

const ok = await verifyHash("my-plain-password", user.password);
if (!ok) {
  // invalid credentials
}

verifyHash is used by Authentication.attempt(...) during login.

Typical model/controller flow

const user = await User.create({
  email: req.body.email,
  password: await bcrypt(req.body.password),
});

// later during auth:
const valid = await verifyHash(req.body.password, user.password);

Never store raw passwords in database rows.

Global helper usage

When global helpers are booted, bcrypt and verifyHash are available directly:

const hash = await bcrypt("secret");
const valid = await verifyHash("secret", hash);

Best practices

• Hash passwords at write time (create/update).
• Always verify with constant-time compare helper (verifyHash) rather than string compare.
• Re-hash with stronger settings when migrating legacy hashes.
• Keep auth errors generic (Invalid credentials) to avoid user enumeration.

Summary

• Use bcrypt(...) to hash passwords.
• Use verifyHash(...) for login/credential checks.
• Framework auth already integrates these helpers in Authentication.attempt(...).