Secure IDs with `hashids`

README.md

Secure IDs

This mixin created two methods to encode & decode your IDs in order to be more secure. Read more about it in hashids.js readme. It generates a Youtube-like ID from Number IDs or Mongo ObjectID.

Usage

Please note, you should define a salt for HashID with HASHID_SALT environment variables.

const SecureID = require("../mixins/secure-id.mixin");

module.exports = {
    name: "posts",

    mixins: [
        DbService,
        SecureID()
    ],

    hooks: {
        before: {
            // Decode ID
            get(ctx) {
                ctx.params.id = this.decodeID(ctx.params.id);
            }
        },

        after: {
            find(ctx, res) {
                // Encode all IDs in the response
                return res.map(entity => {
                    entity.id = this.encodeID(entity.id);
                    return entity;
                })
            }
        }
    }
}

secure-id.mixin.js

"use strict";

const Hashids = require("hashids");
const hashids = new Hashids(process.env.HASHID_SALT || "my-secret");

module.exports = function(opts = {}) {
    return {
        methods: {

            /**
             * Encode ID of entity.
             *
             * @methods
             * @param {any} id
             * @returns {any}
             */
            encodeID(id) {
                if (id != null)
                    return hashids.encodeHex(id);
                return id;
            },

            /**
             * Decode ID of entity.
             *
             * @methods
             * @param {any} id
             * @returns {any}
             */
            decodeID(id) {
                if (id != null)
                    return hashids.decodeHex(id);
                return id;
            }
        }
    };
};