kelektiv / node.bcrypt.js

bcrypt for NodeJs
MIT License
7.4k stars 512 forks source link

hash comparison suddenly fails for two days then works normally is this possible? #970

Closed mohas closed 1 year ago

mohas commented 1 year ago

Hi all, our hash comparison for auth mechanism on our website which was working for several months suddenly failed when using the same password, then succeeds after about two days, is something like this possible? I say it again there was not code or password change involved, maybe someone can shed a light on this matter.

more info: compareing the hashed password to an old stored hash failed while getting a new hash and comparing it succeeds

//this failed and causes our auth mechanism to fail, for two days then fixed by itself
await bcrypt.compare( //returns false for two days then true
            userPswd,
            databasePswd
        )
//made a unit test like this and there is no problem!
const testPswd = bcrypt.hashSync(userPswd, 10)
await bcrypt.compare( //returns true
            userPswd,
            testPswd 
        )

I don't know if this is a good idea but this is the hashes for completeness sake: stored hash $2b$12$5FhjippkEtkE6j0qFkjL9ub9sxSz5G3alQIEmQZIMe/9OjyRc4fJm generated hash $2b$10$aVN5l/VgSi.5kunq3fNjruaw5j/RDsRb4/uop981sQsTdEDoJCd56

I'm using node bcrypt v 5.1.0

pallasite99 commented 1 year ago

Have you checked that the rounds of hashing are same for your UT and application code? I'm a newbie to bcrypt but just wanted to know since I'm planning to use it in a project

mohas commented 1 year ago

Well I think a colleague was messing with salt rounds on the server, I've told everyone not to touch the config and it has been working since, it is a great algorithm use it for sure