Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Passwords should be hashed instead of encrypted #234

Closed
glutengo opened this issue May 31, 2021 · 0 comments · Fixed by #235
Closed

Passwords should be hashed instead of encrypted #234

glutengo opened this issue May 31, 2021 · 0 comments · Fixed by #235
Assignees
Labels
enhancement New feature or request v2.0.0 Stable version with jhipster 7.0.0
Milestone

Comments

@glutengo
Copy link
Contributor

glutengo commented May 31, 2021

Is your feature request related to a problem? Please describe.
Currently, passwords are transformed by the EncryptionTransformer which is provided by the typeorm-encrypted package:


Encryption works two-way: Anything that is encrypted can be decrypted if the decryption key is known. In the case of storing user passwords of a web app, the operator of the web app (administrators, developers or similar) is able to decrypt the passwords of the users and read them. As internet users tend to use the same password for multiple websites, the operator of the web app could exploit this and use the login data (username and password) of the user for example to buy things in an online shop. Therefore, it is desirable that the operators of the web app are unable to decrypt the password. This can be achieved by using a one-way mechanism to obfuscate the password (hashing) instead. If this is the case, the password is transformed by the hashing algorithm before storing it to the database. When the user tries to log in, the entered password is transformed the same way and the hashed passwords are compared.
The NestJS docs suggest using this method: https://docs.nestjs.com/security/authentication
This method is also considered best practise for web apps:
https://cloud.google.com/blog/products/identity-security/account-authentication-and-password-management-best-practices
https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html#background

Describe the solution you'd like
I would suggest replacing the EncryptionTransformer by a newly introduced HashTransformer which also implements the ValueTransformer interface. This transformer should use bcrypt (https://codahale.com/how-to-safely-store-a-password/)
However, ValueTransformers do not support async operations whilst it is recommended to use bcrypt's async method. Therefore this should not be implemented via a ValueTransformer but via TypeORM Entity Listeners instead.

@ghost ghost assigned glutengo May 31, 2021
@ghost ghost added the v2.0.0 Stable version with jhipster 7.0.0 label May 31, 2021
@ghost ghost added this to To do in nodejs blueprint via automation May 31, 2021
@ghost ghost added this to the 2.0.0 milestone May 31, 2021
@ghost ghost added the enhancement New feature or request label May 31, 2021
glutengo added a commit to glutengo/generator-jhipster-nodejs that referenced this issue Jun 1, 2021
glutengo added a commit to glutengo/generator-jhipster-nodejs that referenced this issue Jun 2, 2021
ghost pushed a commit that referenced this issue Jun 7, 2021
Use hash instead of encryption for storing passwords refs #234
@ghost ghost linked a pull request Jun 7, 2021 that will close this issue
@ghost ghost closed this as completed Jun 7, 2021
nodejs blueprint automation moved this from To do to Done Jun 7, 2021
This issue was closed.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request v2.0.0 Stable version with jhipster 7.0.0
Projects
Development

Successfully merging a pull request may close this issue.

1 participant