So as I said last time, there's still one little security hole, it's actually a pretty big security
hole in our application and I'm going to illustrate exactly what that is, because I described it last
time, but it might be helpful to see it.
So I'm only forgot password page and I'll put an example dot com, send the password and go over to
mail trap.
And there it is.
And let's click on this link and everything seems good.
We've made sure that the URL is tamperproof and that seems perfect.
But the problem is if I view the source for this page and then scroll down to the JavaScript part I
have right here at Nenad example dot com, and that's the value we're using on the backend to look up
the user and reset the password.
So if I was a malicious user, I could simply use one of the various tools at my disposal to change
that email to somebody else's email on the system and change their password.
And that's not good.
So we're going to fix that this time around.
And it might take a couple of lectures, but we'll get started right now.
So let's go back to Visual Studio Code.
And what I'm going to do is create a new package.
So it's available to both my front end and my back end.
And it's going to be an encryption package.
I'll call it encryption, and it's going to have two functions in there, one that encrypts something
and one that decrypt something.
Now, the one thing we're going to have to take into account here is that the encryption algorithms
I'm using require a very specific length for the secret key.
It needs to be exactly thirty two characters long.
And that means I need to go to aiport, go and put my default value for my secret key right here on
line sixty nine to something that's exactly thirty two character long.
I've already made one and copied it to my clipboard so I'll paste it in.
So make sure you have a secret key.
That is exactly thirty two characters long just like this one.
Put it in API, go and make sure you put exactly the same value in Maine, Dongo in the CMD Web package.
So I'll find that there's my secret key and I'll paste in my new one.
OK, so now my key is reset and of course that means if you have existing links on your in your mail
trap or whatever mail server you're using, those don't work anymore the next time you run this application
because we have a different secret key.
So let's now go over to our internal package, internal folder and create a new package.
And I'm going to call mine encryption and see your wife again.
And inside of that will create a new file named Encryption Go.
And of course, it has the package encryption
and the very first thing I'll do in here is the same sort of thing we did with the last package.
We made a prototype.
Come on.
Encryption, which may not be the best name, but I'm going to go with that encryption and it's a stroke
and it has one member, which I'm going to call key, and that is a slice of Vitz, OK?
And of course, that's how we'll initiate or instantiate this package when we need to use it.
That key will be our secret key that I just put in April ago and may not go now.
I'll have two functions.
One that has the receiver E of type A pointer to encryption and I'll call that encrypt.
And it's just going to take one value the text to encrypt, which is a strength and it will return a
string that potentially there.
But I'll have another one func e pointer to encryption and it's going to be called, not surprisingly,
decrypt.
And again, it takes one thing which I'll call text, I'll call it crypto text because it's been encrypted.
It's a string and it returns a string and potentially an so we'll take care of encrypting things first.
OK, so this function first of all, we need to get that plain text that we received.
That text and I did change that into a slice of bytes and I'll just call that doesn't matter what I
call it, I'll call it plain text.
And it's a sign the value of to a slice of bitts, whatever he received as a call to this function.
OK, and then we'll create a block which we're going to use for encryption.
So Block, that's just the name of a variable, potentially an error or assign the value of from the
A.D.s package crypto.
Yes, that's the one I want.
I'm going to call New Cipher and I'm going to handed the key, our secret key that's going to be our
cipher.
And we're creating something using that cipher.
OK, so if error is not equal to nil, we'll just say return nothing in the air.
So something went wrong.
Next, let's create something called ciphertext.
And that's going to be a sign of the value of make and we're going to get a slice of bite, a slice
of the pie.
It's a block size which is built right into the Earth package, plus the length of our plaintext.
So we took our string here text.
We converted it to a slice of bytes.
And down here we're saying it should be the block size, the block size, plus the length of however
long that's that slice of bytes is.
And again, we need to do something with that.
So we've got our ciphertext and now we're going to create something.
I'm going to be OK.
And it's going to use or it's going to be a sign, the value of ciphertext, why don't we just created
and we're getting a section from that.
So it's the Luxor's and that better spell that right or nothing is going to work.
S dot boxes, which are Finnair if and we're going to ignore the first return value, but we are going
to pay attention to the error and we're calling, I'll read full and we want it from Rande Reader the
Rand package.
Let's try that again.
Rand the reader.
Livy and we checked for an error, error is not equal to nil, then we'll say return nothing to an empty
string and the error.
Now we're going to create a variable called stream.
And that's a sign the value of ciphered
dot, new C of the encrypt or be encrypted.
And we're handing it the two things we just created, Block and IP and now we call from that variable.
We just created stream.
It has methods associated with it.
We want X or Key Stream and we hand it ciphertext and we're looking for a e.
S block size, followed by a column, that section of the slice and plaintext.
And now we have an encrypted thing.
The problem is I need to put this on a webpage and the way I can ensure that it will always be available
to me, no matter what form I need it in.
I know that I can display text on a Web page, and I know that I can't display certain kinds of things,
like a slice of bytes on a Web page.
So we'll just convert it to be sixty four.
So we'll return and recall the base sixty four package, which is built into the standard library and
we'll make it.
You are all encoding and we'll encode it to a string, which means it's safe to use on a webpage and
we'll put in ciphertext and we'll return no error.
So that will encrypt things for us which is really helpful.
But of course once it's encrypted, we also want to be able to decrypt it.
Unfortunately, the logic is pretty much the same.
It's just in reverse.
So in our decrypt function, the very first thing I'll do is create a variable called ciphertext.
And I'll ignore the second return value, and that's just going to be based sixty four, we need to
decode it.
So base sixty four, dot URL encoding dot decode but I want to decode string actually decode string
and I take the value of this path to this function, which is crypto text.
Now there is potentially an error there which I'm ignoring and you probably shouldn't, but I'm going
to for right now.
Now again, we get a block and an error and those come from s dot cipher.
Same as before.
And again, the key, which is our secret key, which is exactly.
Thirty two characters.
Long check for an error.
If error is not equal to nil, then return nothing.
And the error.
And let's give ourselves some room here.
Now we make sure that the length of our separate text makes sense.
Just a sanity check if Lenn of ciphertext is less than a block size.
And this is not something that we can decrypt.
So we'll return an empty string.
And here, once we get past that, once again we'll create a variable which I'm calling I.B., which
is conventional for cryptographers.
For some reason, I've never understood why ciphertext.
And we're going to call in square brackets, Colen a block size and now ciphertext is equal to ciphertext.
Dog block size,
followed by a colon to get the part that we want to work with and we call stream again or a verbal stream
again and again, this is a sign the value of cyper, new CBF.
So for new CBF, this time we want CFB, CFB Decrypts.
And we have that block and then we call the built in functions stream dot.
Export history, and it takes ciphertext and it takes ciphertext, which seems odd, but it takes it
twice.
OK.
And now we return for the sprint F.
And I'll put in percentages and ciphertext with nowhere, and of course, I need to report the full
package that empty.
I'll just import Emmanuela doesn't seem to want to do it for me.
Right here.
OK.
No errors.
So here's our utility functions, which are now available from both our front end and our back end,
which means we can encoded on the front end, which we have to when we display that password reset page.
And because we have the same secret key on our back end, we should be able to decode it as well.
So we'll take care of implementing this on our password reset functionality in the next lecture.