search

mozilla / login.webmaker.org

Login service for Webmaker.org
https://login.webmaker.org
Mozilla Public License 2.0
33 stars 62 forks source link

Migrate away from native bcrypt with Javascript bindings #386

Closed ryanwarsaw closed 7 years ago

ryanwarsaw commented 7 years ago

We currently use a native version of bcrypt with Javascript bindings as our library of choice. This is problematic because this library lacks pre-built binaries, which forces node-gyp to fallback to manual compilation of the library. This causes issues when setting up login, especially if you don't have your environment setup right.

Let's switch over to something like: https://www.npmjs.com/package/bcryptjs, it's slower but it's written in Javascript entirely and removes the requirement to manually compile bcrypt.

gideonthomas commented 7 years ago

@ryanwarsaw can we proceed with this? I'm trying to get Thimble working with node 6.9.x https://github.com/mozilla/thimble.mozilla.org/pull/1714 and it fails with bcrypt (I get this error).

@cadecairos what do you think?

cadecairos commented 7 years ago

Go for it, hopefully it's just a drop in replacement.

cadecairos commented 7 years ago

HOWEVER.

I just found this, which suggests CPU time available to heroku instances impacts the JS bcrypt much more than you'd expect: https://github.com/dcodeIO/bcrypt.js/issues/42

gideonthomas commented 7 years ago

ughhhhh why can't we have nice things???

ryanwarsaw commented 7 years ago

@gideonthomas No problems at all, I think we can work around this. The folks running the bcrypt module we use have been looking for help to set the pre-built binaries again. I'll make my way over there and see if I can lend a helping hand.