Bcrypt error: illegal arguments String unidentified

Question

here is my complete code

var express = require('express'),
    app = express(),
    mongoose = require('mongoose'),
    bodyParser = require('body-parser'),
    morgan = require('morgan'),
    webToken = require('jsonwebtoken'),
    bcrypt = require('bcryptjs'),
    assert = require('assert');
    Schema = mongoose.Schema,
    secretKey = "omjdiuwkslxmshsoepdukslsj";

//User Schema
var userSchema = new Schema({
    username: {type: String, required: true, index: {unique:true}},
    password: {type: String, required: true, select: false}
})

userSchema.pre('save', function(next){
    var user = this;

    if(!user.isModified('password')) return next();

    bcrypt.hash(user.password, null, null, function(err, hash){
        if(err) return next(err);

        user.password = hash;
        next();
    })
});

userSchema.methods.comparePassword = function(password){
    var user = this;

    bcrypt.compare(password, user.password, function(err, result){
        if(err){
            console.log(err);
        }
        else {
            console.log("passwords match!");
            return;
        }
    })
}

var userModel = mongoose.model('users', userSchema);


//Connecting to Mongo
mongoose.connect("mongodb://localhost/userstories", function(err){
    if(err) {
        console.log(err);
    }
    else {
        console.log("Connected to database!");
    }
});

//Creating Token
function createToken(user){
    var token = webToken.sign({
        _id: user.id,
        username: user.username
    },  secretKey,{
        expiresIn: 30 * 60 * 1000
    })
    return token;
    }

//Middlewares
app.use(bodyParser.urlencoded({extended: true}));
app.use(bodyParser.json());
app.use(morgan('dev'));

//Api's

app.post('/signup', function(req, res){    
    var user = new userModel({
        username: req.body.username,
        password: req.body.password
    })

    user.save(function(err){
        if(err){
            console.log(err);
        }

        else{
            res.json({message: "User created!"});
        }
    })
})

app.post('/login', function(req, res){

    userModel.findOne({username: req.body.username}, function(err, user){
        if(err) console.log(err);

            if(!user){
                res.send("User not found!");
            }
                 else if(user){

                      var validPassword = user.comparePassword(req.body.password);

                       if(validPassword){
                                var tokens = createToken(user);

                                res.json({
                                    success: true,
                                    message: "Successfully logged In",
                                    token: tokens
                                });
                        } 

                            else {
                                    res.send("Invalid password");
                                  }

                     }
    })
});


//Running the server
app.listen(3000, function(err){
    if(err) console.log("port not working");
    else{
        console.log("Everything went just fine");
    }
})

I've tried every approaches and saw all the answers here. But no one seem to come across this illegal argument error. Please figure this one out for me Im sure there is a bug I cant see

you are using user.password !! where is user.password coming from? — Engineer S. Saad
– Engineer S. Saad, Commented Mar 6, 2020 at 5:50

Peoray · Accepted Answer · 2020-03-06 05:55:14Z

6

In your User Schema, you are setting select to false for the password field. This means that anytime you look for a user in the schema as you're trying to do in the login request, you won't get the value of the password field or any other field that has select false defined in the schema.

What you need to do is to specify you need the password when the user is found:

app.post('/login', function(req, res){
  userModel.findOne({username: req.body.username}, 'password', function(err, user){
   // continue
}

This will return only the _id and the password from the DB. If you want to return other fields, you'd have to add them in:

app.post('/login', function(req, res){
  userModel.findOne({username: req.body.username}, 'password firstName lastName email', function(err, user){
   // continue
}

answered Mar 6, 2020 at 5:55

Peoray

1,9353 gold badges15 silver badges24 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

Rishikesh Chandra · Accepted Answer · 2017-08-04 17:06:10Z

3

I have tried the same code for authentication once and got the same error Error: Illegal arguments: string, function.

But I did not see any issue with the code. The thing is, I had registered two users with the same user name and a different password. Then, when I tried to log in with the user name and one password this error occurred and stopped the server.

So it seems that you are also facing the same problem. Make sure there are no errors with this stuff if you do not want to have a bug in your code.

edited Aug 4, 2017 at 17:06

Rishikesh Chandra

6919 silver badges25 bronze badges

answered Jul 3, 2017 at 5:33

Buddhika Priyabhashana

3331 gold badge8 silver badges20 bronze badges

Comments

claviska · Accepted Answer · 2019-05-14 16:27:35Z

3

Check the value of user.password before sending it to bcrypt.compare().

Chances are, you've fetched the user without including the password property, resulting in a value of undefined. This can happen in Sequelize if you set custom attributes or if you're using a scope that excludes props.

answered May 14, 2019 at 16:27

claviska

12.5k3 gold badges29 silver badges54 bronze badges

Comments

Najathi · Accepted Answer · 2020-01-14 16:53:43Z

1

Your code is wrong in this place. You may see it.

var validPassword = user.comparePassword(req.body.password);

If you use bcryptjs thrid party plugins, like that

let validPassword = bcrypt.compare(req.body.password, user.password);

bcrypt.compare(password, hashedPassword);

answered Jan 14, 2020 at 16:53

Najathi

3,0751 gold badge30 silver badges29 bronze badges

Comments

oxk4r · Accepted Answer · 2020-12-06 23:26:46Z

1

In my particular case, I was dealing with this error, checking out all the code up and down unsuccessfully for almost two days. Finally, realized that the column PASSWORD in MariaDB was in uppercase. Theoretically that shouldn't affect at all, but I decided to rename it to lowercase and bum! problem solved.

answered Dec 6, 2020 at 23:26

oxk4r

5277 silver badges19 bronze badges

Comments

Yogesh Umesh Vaity · Accepted Answer · 2021-10-14 15:13:44Z

1

For those using async/await for database calls, make sure you don't forget the await keyword on the User.findOne() call.

In my case, I had forgotten the await keyword while fetching the user. This as a result, was giving me a Promise object instead of User object and hence the password property on it was undefined.

answered Oct 14, 2021 at 15:13

Yogesh Umesh Vaity

49.5k23 gold badges158 silver badges116 bronze badges

Comments

Rishikesh Chandra · Accepted Answer · 2017-08-04 13:09:36Z

0

I also encountered the same error when I was using bcrypt.compareSync("input to be compared with the hash", hash).

Later on I discovered that I was supposed to pass the actual value in the first input parameter i.e (The actual value from which the hash was generated) and the hash in the second input parameter, but I was passing hashed values in both the input parameters.

After correcting the same it was giving me the desired output as true or false.

You can also run and check your code here.

answered Aug 4, 2017 at 13:09

Rishikesh Chandra

6919 silver badges25 bronze badges

Comments

Teuuz1994 · Accepted Answer · 2020-05-17 18:13:47Z

0

Do like this:

UserSchema.pre('save', async function (next) {
  const hash = await bcrypt.hash(this.password, 10);

  this.password = hash;
  next()
})

answered May 17, 2020 at 18:13

Teuuz1994

212 bronze badges

Comments

Shubham Saurav · Accepted Answer · 2020-07-29 07:43:17Z

0

You need to specify that you also want the password because you have set the select property to false on password. So when you are fetching the user, just make sure to explicitly specify that you also want the password. Add .select('+password') on the user object when you are querying a user.

answered Jul 29, 2020 at 7:43

Shubham Saurav

411 silver badge6 bronze badges

Comments

ACV · Accepted Answer · 2021-12-27 11:46:51Z

0

In my case it was a simple spelling mistake before sending to bcrypt.hash :

answered Dec 27, 2021 at 11:46

ACV

10.7k5 gold badges84 silver badges91 bronze badges

Comments

Avtar · Accepted Answer · 2022-02-11 18:05:54Z

0

If you're testing this with Postman, I just found an issue where the default Content-Type header is set to text/plain. If you untick the default header (as it doesn't allow you to change it) and add another Content-Type header with a value of application/json, it works.

answered Feb 11, 2022 at 18:05

Avtar

1732 silver badges17 bronze badges

Comments

Suraj Rao · Accepted Answer · 2023-03-09 05:00:31Z

In my case, the same error was coming so I tried to add await keyword because the function was asynchronous. I don't know how it is working but this worked for me.

async login(req,res,next) {

    const {email,password} = req.body;
    try{
        //first check if user exists or not
        const existinguser = await users.findOne({email:email});//add await here
        if(!existinguser){
            return res.send(404).json({message:`User not found`});
        }
        // console.log(password);
        // console.log(existinguser);
        // console.log("Db password" + existinguser.password);
        const matchedpassword = bcrypt.compare(password,existinguser.password);
        if(!matchedpassword){
            return res.send(401).json({message:`Invalid Credential`});
        }
        const token = jwt.sign({email:existinguser.email,id:existinguser._id},process.env.SECRET_KEY);
        res.status(200).json({
            message:`User is Logged In`,
            token:token
        })
    }
    catch(err){
        console.log(err); 
        next(new CustomError(err.message,500,"Unable to Login"))
    }
}

Collectives™ on Stack Overflow

Bcrypt error: illegal arguments String unidentified

12 Answers 12

Comments

Comments

Comments

Comments

Comments

Comments

Comments

Comments

Comments

Comments

Comments

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

12 Answers 12

Comments

Comments

Comments

Comments

Comments

Comments

Comments

Comments

Comments

Comments

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related