Node.js Backend Development Bootcamp · درس

تشفير البيانات وتجزيئها

تعلّموا تشفير البيانات الحساسة أثناء التخزين والنقل، واستخدام تقنيات التجزئة المناسبة لكلمات مرور المستخدمين

تشفير البيانات وتجزيئها درس مجاني في Node.js Backend Development Bootcamp على CoddyKit. هذا هو الدرس 3 من أصل 4. يمكنك قراءة الدرس كاملاً أدناه مجاناً — ثم تمرن عليه مباشرة في المتصفح باستخدام محرر أكواد مدمج ومدرس ذكاء اصطناعي متاح 24/7. هذا الدرس جزء من مسار التعلم في Node.js Backend Development Bootcamp، وتقدمك يتزامن عبر الويب وتطبيق CoddyKit. تتضمن دورة Node.js Backend Development Bootcamp 4 دروس في المجموع.

بعض أجزاء هذا الدرس لم تُترجم بعد وتظهر باللغة الإنجليزية.

Data Security Essentials

Welcome to Data Encryption & Hashing! In today's digital world, protecting sensitive information is paramount. Whether it's user passwords, personal data, or financial details, securing this data is a core responsibility for any developer.

This lesson will equip you with the knowledge and tools to implement robust data protection strategies in your Node.js applications.

Encryption vs. Hashing

Before diving into techniques, let's understand two fundamental concepts:

Encryption: A two-way process that transforms data (plaintext) into an unreadable format (ciphertext) using a key. It's reversible, meaning the ciphertext can be converted back to plaintext with the correct key.
Hashing: A one-way process that transforms data of any size into a fixed-size string of characters (a hash value or digest). It's irreversible; you cannot get the original data back from its hash.

They serve different purposes!

Symmetric Encryption

Symmetric encryption uses the same secret key for both encrypting and decrypting data. It's fast and efficient, making it suitable for encrypting large amounts of data.

Common algorithms include AES (Advanced Encryption Standard). The key must be kept secret and securely exchanged between parties.

Node.js Symmetric Encryption

Node.js's built-in crypto module allows us to perform symmetric encryption. Here's an example using AES-256-CBC, a strong symmetric algorithm.

Note: In a real application, the encryption key should be securely generated and stored (e.g., in environment variables) and the IV should be random for each encryption.

const crypto = require('crypto');

// IMPORTANT: In production, generate this key securely and store it safely!
const ENCRYPTION_KEY = 'averysecretkeyforencryption123456'; // Must be 32 bytes for AES-256
const IV_LENGTH = 16; // For AES-256-CBC, IV is 16 bytes

function encrypt(text) {
  const iv = crypto.randomBytes(IV_LENGTH);
  const cipher = crypto.createCipheriv(
    'aes-256-cbc',
    Buffer.from(ENCRYPTION_KEY, 'utf8'),
    iv
  );
  let encrypted = cipher.update(text, 'utf8', 'hex');
  encrypted += cipher.final('hex');
  // Store IV with encrypted data (e.g., as 'iv:encryptedData')
  return iv.toString('hex') + ':' + encrypted;
}

function decrypt(text) {
  const textParts = text.split(':');
  const iv = Buffer.from(textParts.shift(), 'hex');
  const encryptedText = textParts.join(':');
  const decipher = crypto.createDecipheriv(
    'aes-256-cbc',
    Buffer.from(ENCRYPTION_KEY, 'utf8'),
    iv
  );
  let decrypted = decipher.update(encryptedText, 'hex', 'utf8');
  decrypted += decipher.final('utf8');
  return decrypted;
}

const message = 'Sensitive data for storage.';
console.log('Original:', message);

const encryptedMessage = encrypt(message);
console.log('Encrypted:', encryptedMessage);

const decryptedMessage = decrypt(encryptedMessage);
console.log('Decrypted:', decryptedMessage);

Asymmetric Encryption

Asymmetric encryption, also known as public-key cryptography, uses a pair of keys: a public key and a private key.

Public key: Can be shared with anyone. Used for encryption.
Private key: Must be kept secret. Used for decryption.

If you encrypt data with someone's public key, only they can decrypt it with their private key. This is slower than symmetric encryption but crucial for secure communication and digital signatures.

Hashing for Passwords

When storing user passwords, NEVER encrypt them. Instead, always hash them. If an attacker gains access to your database, they would ideally only find irreversible hashes, not decryptable passwords.

A good hashing algorithm for passwords should be:

One-way: Impossible to reverse.
Collision-resistant: Extremely unlikely for two different inputs to produce the same hash.
Slow: Deliberately designed to be computationally intensive to deter brute-force attacks.

Salting Passwords

To further enhance password security, we use salts. A salt is a unique, random string added to a password before it's hashed.

Why use salts?

Prevents Rainbow Table Attacks: Without salts, attackers could pre-compute hashes for common passwords (rainbow tables).
Unique Hashes: Even if two users have the same password, their salted hashes will be different.

The salt is usually stored alongside the hash.

Bcrypt for Password Hashing

bcrypt is a widely recommended library for hashing passwords in Node.js because it's designed to be slow and integrates salting automatically.

It handles generating a unique salt and performing multiple rounds of hashing (controlled by saltRounds, a work factor) to make brute-force attacks more difficult.

const bcrypt = require('bcrypt');

async function runBcryptExample() {
  const password = 'mySecretPassword123';
  const saltRounds = 10; // A higher number means more processing time

  console.log('Original Password:', password);

  // Hash the password with a generated salt
  const hashedPassword = await bcrypt.hash(password, saltRounds);
  console.log('Hashed Password:', hashedPassword);

  // Compare a candidate password with the stored hash
  const isMatch = await bcrypt.compare(password, hashedPassword);
  console.log('Password Match (correct):', isMatch);

  const wrongPassword = 'wrongPassword';
  const isWrongMatch = await bcrypt.compare(wrongPassword, hashedPassword);
  console.log('Password Match (wrong):', isWrongMatch);
}

runBcryptExample();

Securing Data in Transit (TLS/SSL)

While encryption and hashing protect data at rest (stored in a database), it's equally important to protect data while it's moving between systems (data in transit).

TLS/SSL (Transport Layer Security/Secure Sockets Layer) protocols provide encryption for network communication. When you visit a website using HTTPS, your browser and the server use TLS/SSL to encrypt all data exchanged, preventing eavesdropping and tampering.

Check Your Understanding

Which of the following statements about encryption and hashing are TRUE?

Recap: Data Protection

Great job! You've learned the fundamentals of data encryption and hashing:

Encryption protects sensitive data, making it reversible with a key.
Hashing provides one-way transformation, ideal for password storage and data integrity.
Symmetric encryption uses a single key, while asymmetric encryption uses public/private key pairs.
Always use strong, salted hashing (like bcrypt) for passwords.
TLS/SSL secures data in transit over networks.

Implementing these practices is vital for building secure Node.js applications!

الأسئلة الشائعة

هل درس «تشفير البيانات وتجزيئها» مجاني؟

نعم — نص درس «تشفير البيانات وتجزيئها» كامل متاح مجاناً هنا على الويب. لتمرينه بشكل تفاعلي (محرر أكواد مدمج ومدرس ذكاء اصطناعي متاح 24/7) وفتح باقي دورة Node.js Backend Development Bootcamp، انتقل إلى CoddyKit PRO. تتضمن دورة Node.js Backend Development Bootcamp 4 دروس في المجموع.

ماذا ستتعلم في «تشفير البيانات وتجزيئها»؟

تعلّموا تشفير البيانات الحساسة أثناء التخزين والنقل، واستخدام تقنيات التجزئة المناسبة لكلمات مرور المستخدمين تتمرن على Node.js Backend Development Bootcamp مع أكواد عملية تشغلها مباشرة في المتصفح، ومدرس ذكاء اصطناعي متاح 24/7 يجيب على أسئلتك أثناء عملك.

هل أحتاج إلى خبرة سابقة لأبدأ Node.js Backend Development Bootcamp؟

لا تُشترط خبرة سابقة. Node.js Backend Development Bootcamp على CoddyKit منظم للمبتدئين حتى المتقدمين، لذا يمكنك البدء من هنا أو من البداية والتقدم بسرعتك الخاصة. هذا هو الدرس 3 من أصل 4.

كم من الوقت يستغرق درس «تشفير البيانات وتجزيئها»؟

معظم دروس CoddyKit تستغرق حوالي 5–10 دقائق. كل منها موجز وتفاعلي، لذا تحرز تقدماً مستمراً وتستأنف من حيث توقفت عبر الويب والتطبيق.

هل يمكنني كتابة وتشغيل أكواد في درس Node.js Backend Development Bootcamp هذا؟

نعم. كل درس في Node.js Backend Development Bootcamp يتضمن محرر أكواد مدمج، لذا تكتب وتشغل أكواداً حقيقية مباشرة في متصفحك وتحصل على تعليقات فورية من الذكاء الاصطناعي — بدون إعداد محلي.

جميع الدروس في هذه الدورة

← العودة إلى Node.js Backend Development Bootcamp