A Cautionary Tale for TypeORM Users in NestJS

In the realm of software development, minute details can often have significant implications. A recent discovery in the TypeORM library, a popular Object-Relational Mapper (ORM) used in NestJS, serves as a reminder of this fact. This article delves into an intriguing behavior encountered while updating a user's password in a NestJS application, highlighting its relevance to developers in North East India and beyond.

The Unhashed Password Dilemma

In a typical scenario, when updating a user's password, it is crucial to hash the password before saving it to the database. However, an unexpected issue arose when this process was not properly implemented in TypeORM. In some cases, the password was saved in plain text, posing a significant security risk.

Scenario 1: The Plain Text Password

In the first scenario, a password hashing function was defined within TypeORM entity hooks (@BeforeInsert() and @BeforeUpdate()). However, the password was not hashed as expected. Upon investigation, it was discovered that TypeORM did not detect a field change, causing the @BeforeUpdate() hook to fail to trigger, leading to the password being saved in plain text.

Scenario 2: The Hashed Password

In the second scenario, the issue was resolved by updating another field (updatedAt) alongside the password. This triggered TypeORM to detect a change and subsequently run the @BeforeUpdate() hook, ensuring that the password was properly hashed before being saved.

The Key Takeaway

The key takeaway from this experience is that when relying on TypeORM entity hooks like @BeforeUpdate(), it is essential to ensure at least one other field changes. If this is not done, the hook may not run, and important logic (like password hashing) can fail silently.

Implications for North East India and Beyond

This issue is particularly relevant to developers in North East India, given the growing adoption of NestJS and TypeORM in the region. It serves as a reminder of the importance of paying close attention to detail when working with sensitive data like passwords. Furthermore, this incident underscores the need for continuous learning and testing in software development to ensure the security and integrity of our applications.

Looking Forward

As we navigate the dynamic landscape of software development, encounters such as this one serve as valuable learning opportunities. By sharing our experiences and insights, we can collectively strengthen the security and efficiency of our applications, benefiting the broader Indian and global development community.