-
Notifications
You must be signed in to change notification settings - Fork 12
Open
Labels
buggy-fileFiles that are intentionally buggy or brokenFiles that are intentionally buggy or brokenneeds-reviewNeeds human reviewNeeds human reviewsecuritySecurity related issuesSecurity related issues
Description
As a developer
I want to use a stronger bcrypt cost factor when hashing passwords in src/javascript/backend/auth/authentication.js
So that user passwords are hashed with sufficient work factor to resist brute-force attacks
Acceptance Criteria
- Replace
bcrypt.hash(password, 8)with a configurable, stronger cost (e.g. 12 or higher) or use an environment-configured value. - Add a comment explaining why the chosen cost is appropriate and how to tune it.
- Run a basic test demonstrating hashing and verification still succeed.
Details
Found: const hashedPassword = await bcrypt.hash(password, 8); (insufficient rounds). This is a security weakness in the JS. Adjust the cost and make it configurable.
Reactions are currently unavailable
Metadata
Metadata
Assignees
Labels
buggy-fileFiles that are intentionally buggy or brokenFiles that are intentionally buggy or brokenneeds-reviewNeeds human reviewNeeds human reviewsecuritySecurity related issuesSecurity related issues