Skip to content

Fix example of Crypto::BCrypt.new(String, String, Int). #15931

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 3 commits into
base: master
Choose a base branch
from

Conversation

hugopl
Copy link
Contributor

@hugopl hugopl commented Jun 26, 2025

Current example just doesn't work, since it expects a base64 encoded string.

# ```
# require "crypto/bcrypt"
#
# password = Crypto::Bcrypt.new "secret", "salt_of_16_chars"
# password = Crypto::Bcrypt.new "secret", "0102030405060708090a0b0c0d0e0f10"
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

suggestion: The sample string looks like hexadecimal. Maybe we could put some other characters to clearly show that it's actually base64 encoded?

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Every password should have a different salt so let's generate it:

Suggested change
# password = Crypto::Bcrypt.new "secret", "0102030405060708090a0b0c0d0e0f10"
salt = Base64.encode(Random::Secure.random_bytes(16))
password = Crypto::Bcrypt.new "secret", salt)

Copy link
Member

@straight-shoota straight-shoota Jun 27, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If we're generating a random salt, we would probably use the other overload with Bytes directly, without going through the base64 encoding. Or better just the .hash_secret method. Or just Bcrypt::Password.

And for individual examples, I think it's generally best to keep them short with deterministic input and output. The goal is to demonstrate the functionality of a single method.

The password itself clearly shouldn't be "secret" either. For this particular method's documentation, a string literal is fine.

We might want to enhance the documentation of BCrypt with a practical guide for end-to-end integration with production-ready examples (or not: #15276). That's out of scope here, though.

hugopl and others added 2 commits June 27, 2025 14:55
Co-authored-by: Johannes Müller <straightshoota@gmail.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants