search

dcodeIO / bcrypt.js

Optimized bcrypt in plain JavaScript with zero dependencies.
Other
3.47k stars 264 forks source link

Trailing underscores are not accounted for. #133

Open savoygrizzly opened 2 years ago

savoygrizzly commented 2 years ago

When using bcrypt.compare(password, user.password) with the original hashed user.password being something and the supplied password being something__ or something_, bcrypt.compare will return true.

Just wondering if this is intended behavior, if it is I'd consider this VERY bad practice.

dcodeIO commented 2 years ago

The following works as expected and does not return true:

var hash = bcryptjs.hashSync("something");
var result = bcryptjs.compareSync("something_", hash);
console.log(result); // logs false

Note, though, that the maximum input length is 72 bytes as explained in the README, so if the input is longer than that, remaining bytes are truncated, which might explain the behavior.