It implements a login function that authenticates users compared to the value of the database. When I run node red and enter id/pw for the first time, it works fine. Compare the values with DB to move on only when they match. However, I come back to the login screen and leave the input empty and ju…

[image] 2shlee: How do I query SQL to be safe..? mysql prepared statements at DuckDuckGo DuckDuckGo. Privacy, Simplified. mysql sql injection prevention at DuckDuckGo DuckDuckGo. Privacy, Simplified.

Still trying to work through the logic. However: You are not using HTTPS which means that all passwords are already potentially compromised. HTTPS must be implemented before any login. action="http://192.168.0.18:1880/login_action" is very fragile. I think that action="./login_action" would be mor…

The function named "입력한 value에 대해 set global" - when setting, you've only allowed for a SINGLE USER. If multiple people try to log in, only the last person to do so would be recorded - is that what you wanted? And, you haven't validated the inputs. While you've tried to validate user input in the b…

The function named "입력한 Username이 mySQL에 존재하는지 확인" seems to contain the most fundamental and terrible mistake any developer can make! You appear to be appending raw user input to a SQL query? [image] You MUST use a prepared statement for your query (that is more efficient anyway) and you MUST ens…

Thank you for your advice. That's a very bad coding for security. How do I query SQL to be safe..?

Then, using the prepared statement like [ PREPARE insert_user FROM 'INSERT INTO users (username, email) VALUES (?, ?)'; ] instead of the [SELECT ~~ ], right? I'll give it a try. Thank you for your help!!

Yes, but make sure you trim and sanitise the input strings. For example, your user names probably no longer than 64 chars and your passwords probably the same. Passwords also not less than 8 chars. Email address also no longer than 64 chars perhaps and must contain an @. And none of the inputs shoul…

So, all I have to do is The id/pw-related input value stored in the global variable should be deleted. It is necessary to verify the input value. You have to encrypt and save your password. I have a question! How do I verify the input value of a password or ID in Nodered? And the sqlquery that …

I have one more question.... I want to display the successful login username on the dashboard. And I also want to have my user ID and logout time logged in db when I log out, do I have to reset the global variable? Is there any other way?

[image] 2shlee: How do I verify the input value of a password or ID in Nodered? The point of a hash is that it is a 1-way cryptographic formula. As long as you apply the same formula to the same input, you get the same hash. So it is the hashes that you compare. The hash is stored in the db i…

There is one more area of obstruction. Didn't you say that the password should be hashed and stored in the database? But the bcrypt module is not available in Nordred. So, I found it in Palette and tried this module. ( However, the password that was encrypted and stored at the time of membership …

Node-RED

Node-RED Forum

Please check my HTTP login Flow

General

zenofmud 25 March 2024 10:07 13

Closing this thread since you opened a new thread about this obstruction

Topic		Replies	Views
Need Help to Create Login and Sign Up Page with Session Dashboard	7	11572	18 November 2020
[login/join] password bcrypt with mysql General security , function-node , dashboard-2	7	252	27 June 2024
Help with creating a login page using a dashboard Dashboard node-red-dashboard , function-node	5	177	15 May 2024
Example of a simplified dashboard security system for local networks. (Privacy) Share Your Projects	15	924	1 August 2021
(adminAuth) unable to login node-red General	45	13426	11 April 2021

Copyright OpenJS Foundation and Node-RED contributors. All rights reserved. The OpenJS Foundation has registered trademarks and uses trademarks. For a list of trademarks of the OpenJS Foundation, please see our Trademark Policy and Trademark List. Trademarks and logos not indicated on the list of OpenJS Foundation trademarks are trademarks™ or registered® trademarks of their respective holders. Use of them does not imply any affiliation with or endorsement by them.

Please check my HTTP login Flow

Related topics