Question

I want to ask it is better to make a query in mongo db like this:

db.users.findOne({'username': 'example', 'password': '5f189664bb2e58d4e2ee879835b13a7e3a790e14'})

Or make the check of the password hash in a if condition like this:

user = db.users.findOne({'username': 'example'})
if user['password'] == passwordHash:
    print "Hello user"

Thanks! Jarus

Answer 1

It depends on what you want to do if the user is found but the password is wrong.

• If you want to display “Incorrect username or password” you can use either method.
• If you want to display “Incorrect password” you need the second method as the first method cannot distinguish between the username being valid and the password being wrong, and the user not existing.

Note: If you want to keep your system secure you should probably prefer the first method over the second. The second method follows different code paths depending on whether the username exists and the password is wrong, or if the username doesn’t exist. This can result in leaking information about what usernames exist on your system, which can be useful for attackers.