Next.js Discord

Discord Forum

Security risks sending password from a client component to a server action

Answered
Balinese posted this in #help-forum
Open in Discord
BalineseOP
I'm a relatively new dev working on the sign up feature for a production app and am trying to move the user setup (authentication, user data to database) into a server action. I created a server action that takes in the form data and uses it to create a user auth account and add user data to the DB using the Firebase Admin SDK.

Since the password (as a string) is part of the form data, should I be hashing it before sending it to the server action?

On the client form upon hitting submit button:
await SetUpUser(userData) // Server action to create user auth and data in database
await signIn(userData.email, userData.password) // Sign in client


On the server action:
const userRecord = await auth.createUser({
            email:userData.email,
            password:userData.password,
        })
const userRef = firestore.collection('users').doc(userRecord.uid)

        await userRef.set({
            firstname: userData.firstname,
            lastname: userData.lastname,
            company: userData.company,
            email: userData.email,
            created: Firestore.FieldValue.serverTimestamp(),
            })
Answered by B33fb0n3
as far as I know you don't need to hash it. Even if you would use a route handler, you send the password as plain text as post request to it. And post requests are secure. If you safe the password in your database, then you should hash it. I am not familiar with firebase, but I think they do that automatically. You should check that 👍
@Balinese
View full answer

7 Replies

as far as I know you don't need to hash it. Even if you would use a route handler, you send the password as plain text as post request to it. And post requests are secure. If you safe the password in your database, then you should hash it. I am not familiar with firebase, but I think they do that automatically. You should check that 👍
@Balinese
Answer
oh ok got it. Yea as I said 🙂
please mark solution
BalineseOP
how do I do that