search

nhost / hasura-auth

Authentication for Hasura.
https://nhost.io
MIT License
376 stars 111 forks source link

Hash is salted using a constant #411

Closed mmmmillar closed 1 year ago

mmmmillar commented 1 year ago

https://github.com/nhost/hasura-auth/blob/44c7d9e1abb7a0d80189f792692fc3bda4ca9aa9/src/utils/password.ts#L8C38-L8C38

Password hashes are currently salted using a constant value - matching passwords across different databases are going to share the same hash

dbarrosop commented 1 year ago

I don't think your assessment is correct but feel free to correct me if I am wrong. Based on the library's documentation:

https://www.npmjs.com/package/bcryptjs#hashs-salt-callback-progresscallback

if the salt is a number it autogenerates a salt of that length.

mmmmillar commented 1 year ago

my bad! thanks for the correction