Hello and welcome to the next reader in this project.
So long a previous video we have saw or we have seen what what is authentication, security and also
the level one implementation of authentication security.
That is Dash to register the users with usernames and passwords in the database.
Now the Level two will be database encryption.
That means not only storing the username and password of the users in the database, but also we encrypt
them so that now if anyone sees them, they don't understand what is the actual password.
They need to decrypt it for decryption.
They need to have the secret key.
So basically, we see how to do that.
For that will follow some procedure.
So let me write down the procedure step by step.
The first one we are going to use is Mongoose encryption in a package.
So if you go to Google and search for Mongoose encryption.
You'll be getting the yeah, you'll be getting a and B back, isn't it?
This is Angus feel encryption between search for Mongoose encryption.
This one.
So this one is the package that we are going to use.
So as you can see, encryption and multiplication for longer mungo's documents.
OK, it uses crypto modern.
That means cryptography.
Cryptography is a technique, so it's a whole different module itself, OK?
It is a whole different subject if you want to study.
So cryptography has many, many things and many, you know, many different technology, many different
techniques to this encryption decryption of data.
So how it works if you want to know how it works, you can go through this.
So now before we get started, until this is this is how you have to use that first thing, you have
been install npm, install mongoose encryption, the second one using it, how to use it.
So there is a whole different documentation given here.
You can see an understanding how to use it and how to implement it.
Everything.
But we'll see a short way of implementing it.
So after completing this, so basically.
Here in this Mongoose encryption, it can do both encryption and decryption.
OK.
But now will all this will only concentrate on encryption?
That is how to encrypt a given username and password and then started in the database.
Then the first thing is installing required the package install and.
Require the package.
So this is the first thing of this Mongoose encryption.
What is the second thing?
We define a secret, which is a long string, and we use that secret to encrypt our database.
The second one will be defining.
A secret.
The third one, you can check the documentation for the court.
We have to change the court so that only certain things are getting encrypted, so just password because
we don't want the username to be encrypted because using them if the like in, for example, if we take
some social networking app username is something that you just have to see so that they can contact
you, they can see what you're sharing your posts on the social media.
So Tony, the password for logging into that account to be encrypted, so we have to encrypt only.
Certain things that.
So once you're done this.
Now we have our apologies, right?
So we have our user schema, user schema.
We want to.
The secret is a string, this password is extremely vulnerable and this password string.
So how to encrypt?
By using this Mongoose encryption model, we have imported the Mongoose encryption model and then we
are initially using it for the plugin you want to see.
So this is basically the code for database encryption.
First, we are defining a constant secret key that is, you can give any key here I'm giving.
This is my secret key, but you can do anything.
And once getting that, you have to give this plugin to the user schema, so you this command plugin.
Here we are mentioning the method that is anchored and then secret will be the secret key and what feels
to be encrypted.
So here we want only the password field to be encrypted.
OK?
So these are all there will be two parameters one parameters.
And if you decrypt and the second parameter details about this schema and the secret key.
So once we do this, that's.
Nothing changed.
No changes, trapdoors.
So what it will do, it will just save the day, save the data in the database in encrypted form.
That's it.
Then it will not change in the posture.
OK.
This is database encryption, and this is how the second level of authentication security is done before.
And in this video, we'll discuss what is plugins.
So basically, plugins are just extra bits of package code that you can add to the Mongo schemas to
extend the functionality or give them more powers, essentially.
OK.
So one more thing is during see if the documents are encrypted and during find the documents are decrypted.
So what it will do is whenever you give this plug into this, you schema, it will automatically encrypt
during setup and automatically be capable of finding the like when searching some data.
So what is the pain point here means?
What is the disadvantage?
So if anyone have access to dogs, can see this user.
For example, this is the code I'm writing, Man Burgess, since here it is not.
I am commenting.
Everything we're concerned about is if you are implementing database encryption by using the Bongo's
encryption meter, basically have this code.
That means anyone who can have this access to this file, they can have access to this secret can the
whole database.
So this is the pain point.
So how can I why this?
That is by using environment variables so that see in the next shooter that is the level three of security?
Not indication?
Thank you.