[Bug] Passwords Stored in Plain Text in `localStorage`

[SatyamPandey-07]

Label: security bug
Priority: 🔴 High

Description

Teacher passwords are stored and compared as plain text strings inside localStorage. This means anyone with browser DevTools access can instantly read every teacher's credentials.

Affected File

src/context/AuthContext.jsx

Steps to Reproduce

1. Register a new teacher account on the Login page.
2. Open browser DevTools → Application → Local Storage.
3. Find the key lecturePulse_teachers_db.
4. Observe that the password field is stored in plain text.

Code Reference

// AuthContext.jsx — Line 47
teachers[teacherId] = { name, password };  // ← plain text password saved!
localStorage.setItem("lecturePulse_teachers_db", JSON.stringify(teachers));

// AuthContext.jsx — Line 27
if (user && user.password === password) { ... }  // ← plain text comparison

Expected Behavior

Passwords should never be stored in plain text. They should be hashed before storage and compared using a hash-safe method.

Suggested Fix

Use the Web Crypto API to hash the password with SHA-256 before storing:

async function hashPassword(password) {
  const msgBuffer = new TextEncoder().encode(password);
  const hashBuffer = await crypto.subtle.digest('SHA-256', msgBuffer);
  const hashArray = Array.from(new Uint8Array(hashBuffer));
  return hashArray.map(b => b.toString(16).padStart(2, '0')).join('');
}

Then store and compare only the hashed value.

Caution

This is a security vulnerability. Even in a prototype/hackathon project, plain text passwords in localStorage expose all teacher accounts to anyone with physical or remote DevTools access.

[shravya290706]

Hi,
I'd like to work on this issue as part of SSoC 2026.
Could you please assign this issue to me?
Thank you!

[SatyamPandey-07]

@shravya290706 go

[prakhar4684]

Hi, I’d like to work on this security issue. I’ll replace plain text password storage with hashed passwords, update authentication comparison logic, and ensure credentials are no longer exposed in localStorage. Please assign it to me.