Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix Use of password hash with insufficient computational effort #1725

Open
wants to merge 4 commits into
base: master
Choose a base branch
from

Conversation

gitworkflows
Copy link

@gitworkflows gitworkflows commented Oct 23, 2024

gitworkflows Medium gitworkflows /fix-password-hash → Lissy93/dashy Commits: 4 | Files Changed: 4 | Additions: 133 Label Unchecked Tasks Powered by Pull Request Badge

Category:

One of: Bugfix / Feature / Code style update / Refactoring Only / Build related changes / Documentation / Other (please specify)

Overview
To fix the problem, we need to replace the use of sha256 with a more secure password hashing algorithm, such as bcrypt. This will ensure that the hashed passwords are computationally intensive to crack, providing better security.

  1. Import the bcrypt library.
  2. Replace the makeSubHash function to use bcrypt for hashing the password.
  3. Ensure that the bcrypt hash is truncated to the same length (14 characters) to maintain existing functionality.

Issue Number (if applicable) #00

New Vars (if applicable)

If you've added any new build scripts, environmental variables, config file options, dependency or devDependency, please outline here

Screenshot (if applicable)

If you've introduced any significant UI changes, please include a screenshot

Code Quality Checklist (Please complete)

  • [*] All changes are backwards compatible
  • [*] All lint checks and tests are passing
  • There are no (new) build warnings or errors
  • (If a new config option is added) Attribute is outlined in the schema and documented
  • (If a new dependency is added) Package is essential, and has been checked out for security or performance
  • (If significant change) Bumps version in package.json

Copy link

netlify bot commented Oct 23, 2024

Deploy Preview for dashy-dev failed. Why did it fail? →

Name Link
🔨 Latest commit 527c12a
🔍 Latest deploy log https://app.netlify.com/sites/dashy-dev/deploys/671891f6a698570008da33b5

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant