Log in process is not working on Angular and Express

I've recently got myself in a problem while I was doing a personal project using Angular, Express and MySQL. I was doing the resetting password process: when a user forgets the passwords, the user sends the logged in email, it receives a token where he/she can reset the password. But when I try to re-logging with the new password, it says in an alert:

Password doesn't match! 4 attempts remaining!


I can't seem to find the problem. The resetting password process works according to the Bootstrap alerts I receive. I even tried to copy and paste the new password before clicking the reset button.

I tried to sign up again by deleting the user from database, made sure that the passwords I entered were the same to the resetted passwords I saved. From that I realized that the log in is not working properly.

I also checked whether the passwords were the same and they were:

Entered pwd: $2a$12$Pi7PcHbt0jt70idePevAK.LilnW5Vrz1OWj5tQV8YivDxX3xiKiN
Database pwd: $2a$12$Pi7PcHbt0jt70idePevAK.LilnW5Vrz1OWj5tQV8YivDxX3xiKiN


I encrypt passwords using bycrypt.js. But the encryption is not the problem with this issue.

Here's the code I've got for this process: Angular:

logIn(): void {
if (this.logInForm.valid) {
const formData = this.logInForm.value;
formData.userPwd = this.encryptPassword(formData.userPwd);
this.httpClient.post('http://localhost:3000/log-in', formData).subscribe(
(response) => {
const message = (response as LogInResponse).message;
this.appendAlert(message, "success", 1);
this.logInSuccess = true;
},
(error: HttpErrorResponse) => {
this.appendAlert(error.error.message, "danger", 1)
if (error.error.message.includes('Account locked')) {
this.logInForm.disable();
setTimeout(() => this.logInForm.enable(), 300000); // 5 minutes
}
}
);
}
}


Express:

// Log-in endpoint
router.post('/log-in', (req, res) => {
const { userName, userPwd } = req.body;
const sql = 'SELECT * FROM users WHERE name = ?';

connection.execute(sql, [userName], (err, results) => {
if (err) {
console.error('Error while logging: ', err);
return res.status(500).json({ error: 'Oops! Something went wrong! Please try again later.' });
} else {
if (results.length === 0) {
return res.status(400).json({ message: `Username doesn't exist! You may sign up or try again.` });
} else {
const user = results[0];
console.log(results);
const now = new Date();

if (user.lock_until && now < new Date(user.lock_until)) {
return res.status(400).json({ message: `Account locked. Try again later. Account will be unlocked at ${user.lock_until}`});
} else {
if (bcrypt.compareSync(userPwd, user.pwd)) {
connection.execute('UPDATE users SET failed_attempts = 0, lock_until = NULL WHERE name = ?', [userName]);
return res.status(200).json({ message: 'You successfully logged in!' });
}
else {
let failedAttempts = user.failed_attempts + 1;
let lockUntil = null;

if (failedAttempts >= 5) {
lockUntil = new Date(now.getTime() + 5 * 60000); // 5 minutes lock
}

connection.execute('UPDATE users SET failed_attempts = ?, lock_until = ? WHERE name = ?', [failedAttempts, lockUntil, userName]);
return res.status(400).json({ message: `Password doesn't match! ${5 - failedAttempts} attempts remaining!` });
}
}
}
}
});
});

Continue reading...