Instructor walkthrough and answer key

1. In the student app folder run node server.mjs. Open http://127.0.0.1:3000.
2. Register Campus-demo-42!. Correct password gives 200; Wrong-demo-42! gives 401.
3. Inspect and decode. The Base64 text decodes to the exact fictional password.
4. Register the same password again. The value is identical because encoding is deterministic.
5. Stop the server. Running node checks.mjs gives five passes, two failures, and exit code 1. This is the intentional baseline.
6. In password-store.mjs, change the storage line to return await hashPassword(password); and the checking line to return await verifyPassword(password, stored);.
7. Save and restart with node server.mjs. Refresh and register again. Storage now starts scrypt$131072$8$1$; decode returns recoveredPassword: null.
8. Correct/wrong checks remain 200/401. Registering the same password again yields a different record; correct login still succeeds.
9. Stop and run node checks.mjs: all seven pass, exit code 0.

Expected explanations

• A working login checks functionality, not how stored credentials survive disclosure.
• Base64 is a reversible representation with no secret key. Encryption is reversible with a key. Password hashing supports verification without a decoding operation.
• Each registration generates a random 16-byte salt. The record stores salt, parameters and hash. A salt is public; it is not a secret encryption key.
• Verification derives a result from the submitted password using the stored salt and settings, then compares fixed-length bytes. Creating a new salted hash and comparing complete strings is wrong.
• A failed decoding demonstration is narrow evidence. Hashes still allow offline guessing; scrypt raises its cost. Weak passwords are not made unguessable.
• Additional protections might include HTTPS, appropriate rate limiting, MFA or secure session management. Any one relevant answer with a short explanation is sufficient.

Common student mistakes

Changing only registration makes verification incompatible. Changing only checking rejects existing Base64 records. Saving without restarting runs the old module. Restarting without re-registration leaves no account. Hiding inspector text does not change actual storage.

The checks invoke a separate fresh server. They do not test the student's browser account. When guiding students, use the worksheet edits on a clean exported copy, not the supplied solution, so the starting experience stays reproducible.