1

I'm creating the custom login page for customer community. Login page has functionality like, Save Username Password, Remember me.

When I check the Save Username Password while login, then at the time of next login, Username and password field are auto-populate. This implemented by using jQuery and cookies.

When I click remember me then it will skip the login page while next login. this implemented by calling action in <apex:page> which called the controller method while VF page load. controller method check cookies available and login.

I'm storing cookies in jQuery and for remember me functionality login, I'm getting that cookies(Username, Password) in apex class.

Presently In cookies, password is not in encrypt form. Now I've store the password in encrypt form. How to encrypt the password in jQuery and decrypt the password in apex class.

Calling action in page like :

<apex:page sidebar="false" controller="demo2Controller" action="{!directlogin}" showheader="false" standardStylesheets="false">

script of Vf Page:

function submitbtn(){
      var username = $("[id$='username']").val(); 
      var password = $("[id$='password']").val(); 
      if($("[id$='UserPass']").is(":checked")){
            $.cookie('apex__username', username, { expires: 14 });
            $.cookie('apex__password', password, { expires: 14 });
            $.cookie('apex__remember', true, { expires: 14 });
        }
        else  if($("[id$='directlogin']").is(":checked"))
        { 

            $.cookie('apex__username', username, { expires: 14 });
            $.cookie('apex__password', password, { expires: 14 });
            $.cookie('apex__directlogin', true, { expires: 14 });
        }
      console.log($.cookie("apex__password"));
      console.log(CryptoJS.MD5(password));
     //here we have to encrypt the password. 
      $.cookie('apex__encryptpassword', CryptoJS.MD5(password), { expires: 14 });

     controllerMethod();
}

controller part:

public PageReference directlogin(){
Cookie getPass = ApexPages.currentPage().getCookies().get('encryptpassword');
          password =  getPass.getValue();
//here we have to decrypt the password. 
}
2

It’s probably not the answer you want to hear but this approach sounds everything but safe to be honest. In order to encrypt it you will need a secret. You would need to store this key in sf and then expose it to jquery (NOT SAFE). I would recommend using a password browser extension like LastPass if needed but would never store the password on the client side.

Also, I have never seen the option on any portal/website that allows me to store the password.

0

As you are using crypto-js to encrypt your data . And the MD5 enccryption format so when I google it I found

MD5 means a 128-bit encryption algorithm, generating a 32-character hexadecimal hash, whatever the captcha. This algorithm is not reversible, ie it is normally impossible to find the original word from the md5 hash.

So its not possible to decrypt it using this way. So you have one alternative solution here. Pass the username, password in apex using apex:param or any other approach then in apex you can encrypt decrypt them easily.

// Generate an AES key for the purpose of this sample. 
// Normally this key should be stored in a protected custom setting 
// or an encrypted field on a custom object
Blob cryptoKey = Crypto.generateAesKey(256);

// Generate the data to be encrypted.
Blob data = Blob.valueOf('Test data to encrypted');
// Encrypt the data and have Salesforce.com generate the initialization vector
Blob encryptedData = Crypto.encryptWithManagedIV('AES256', cryptoKey, data);
// Decrypt the data - the first 16 bytes contain the initialization vector
Blob decryptedData = Crypto.decryptWithManagedIV('AES256', cryptoKey, encryptedData);

// Decode the decrypted data for subsequent use
String decryptedDataString = decryptedData.toString();

Using the Apex Crypto Class

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.