Nemcio/NodeBB
1
0
Fork 0
mirror of https://github.com/NodeBB/NodeBB.git synced 2025-11-01 19:46:01 +01:00
Code Issues Packages Projects Releases Wiki Activity

feat: allow passwords with length > 73 characters (#8818)

Browse Source 
* feat: allow passwords longer than 73 characters

Context: A bcrypt/blowfish limitation means that password length is capped at 72 characters. We can get around this without compromising on security
by hashing all incoming passwords with SHA512, and then sending that to bcrypt.

https://dropbox.tech/security/how-dropbox-securely-stores-your-passwords

* feat: add additional test for passwords > 73 chars

* fix: remove 'password-too-long' error message and all invocations

* test: added test to show that a super long password won't bring down NodeBB

* fix: remove debug log

* Revert "fix: remove 'password-too-long' error message and all invocations"

This reverts commit 1e312bf7ef.

* fix: added back password length checks, but at 512 chars

As processing a large string still uses a lot of memory
This commit is contained in:
Julian Lam
2020-11-06 08:40:00 -05:00
committed by GitHub
parent 113d3324fb
commit 512f6de6de
8 changed files with 73 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
test/user.js
View File

@@ -584,7 +584,7 @@ describe('User', function () {
},
}, function (err, results) {
assert.ifError(err);
Password.compare('newpassword', results.password, function (err, match) {
Password.compare('newpassword', results.password, true, function (err, match) {
assert.ifError(err);
assert(match);
assert.strictEqual(results.userData['email:confirmed'], 1);