Encrypt and decrypt data with a key

Total.js 5 · total5@0.0.19 securitycrypto Executed against Total.js 5

ENCRYPT(value, key) serializes a value to JSON and returns an opaque text. DECRYPT(text, key) returns the original value, or null when the text was changed, is not valid, or was encrypted with another key. The secret setting of your config is mixed into the key, so tokens made on one installation do not open on another.

Use it for password reset links, invitation tokens and anything you need to hand to a client and verify later without storing it. Put an expiration inside the value (a timestamp) and check it after decrypting.

config

secret : change-this-secret-in-production

controllers/tokens.js

exports.install = function() {
	ROUTE('GET /token/', create);
	ROUTE('GET /verify/', verify);
};

function create($) {
	var token = ENCRYPT({ userid: '123', expire: Date.now() + 60000 }, 'reset-password');
	$.json({ token: token });
}

function verify($) {

	var data = DECRYPT($.query.token || '', 'reset-password');

	if (!data || data.expire < Date.now()) {
		$.invalid(401);
		return;
	}

	$.json({ userid: data.userid });
}