Checking a user's password in meteor JS

Question

In my Meteor application I want to change another user's password. I would like to know if there is any way to get the old password before changing it.

This is my server side method:

 updateuser(id,password, options) {
    try {
        Meteor.users.update({ _id: id }, { $set: options })
        Accounts.setPassword(id, password, options)
    }
    catch (e) {
        return false;
        throw new Meteor.Error(500, 'updateUser error', e);
    }
}

I would like to know if the old password is correct or not.

Answer 1

You cannot get the old password as it is hashed, but you can check whether or not it is correct if you have it in plaintext.

You can use the Accounts._checkPassword(user, password) methods in order to check if the old password is correct. It is implemented here.

user should be the user object and password should be the plain text password string.

If the result (which is an object) does not contain an error property, then the password is correct.

You can also take a look (for inspiration) at the implementation of the method used for handling calls to Accounts.changePassword(oldPassword, newPassword, [callback]), which changes the current user's password.

---

If you don't want to send the plain text password to the server (and it is generally better not to send the plain text version), you can hash it on the client using SHA256, by passing it to Accounts._hashPassword(plainTextPassword) (implemented here, in the accounts-password package).

// on the client
>>> Accounts._hashPassword("foobar");

{
  "digest":"c3ab8ff13720e8ad9047dd39466b3c8974e592c2fa383d4a3960714caef0c4f2",
  "algorithm":"sha-256"
}

Call your server method with the results of this function. Assuming you have the SHA256 hashed password as oldPassword in your method:

//on the server
const user = Meteor.users.findOne(userId);
Accounts._checkPassword(user, "wrongPassword");
// results in:
{ userId: 'theuserid',
  error: 
   { [Error: Incorrect password [403]]
     error: 403,
     reason: 'Incorrect password',
     details: undefined,
     message: 'Incorrect password [403]',
     errorType: 'Meteor.Error' } }

Accounts._checkPassword(user, oldPassword);
// results in the following if the password is correct
{ userId: 'theuserid' }