I am working on a hospital project where each doctor must have access to his/her patient's documents and his/her own documents only. Here is my current db structure:
I will give doctors, their passwords by hand. So that's why, I am thinking about creating some passwords, hashing and salting them. Storing the passwords on a paper, not on any part of the PC.
When it comes to the database access, my doctors should be able to access their own documents and update their patients documents.
Here is what I think for signing in a user :
- Get the entered password from the user.
- Hash the password.
- Salt the password.(Salt is fetched from the db)
- Get the hash value of users password from db and check their equality.
- Let the user in if they are equal.
- Get the user's Uid.
- Let the user access to the documents with the Uid of their own or their patients. (This seems now right for me. But i don't know a better way.)
I doubt step 7 mostly. Showing me a better way or a document about it or telling me why doing so is secure will be very helpful. Thanks in advance.