Kubero V3 refactoring #619
Conversation
(WIP) add initial auth function
|
Progress
|
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
… in path expression Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
|
|
||
| const password = crypto | ||
| .createHmac('sha256', process.env.KUBERO_SESSION_KEY) | ||
| .update(pass) |
Check failure
Code scanning / CodeQL
Use of password hash with insufficient computational effort High
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix AI about 11 hours ago
To fix the problem, we need to replace the current password hashing method with a more secure one, such as bcrypt. This will involve:
- Importing the
bcryptlibrary. - Updating the
validateUsermethod to usebcryptfor password comparison. - Ensuring that the
bcryptlibrary is installed as a dependency.
| @@ -13,3 +13,3 @@ | ||
| import { JwtService } from '@nestjs/jwt'; | ||
| import * as crypto from 'crypto'; | ||
| import * as bcrypt from 'bcrypt'; | ||
|
|
||
| @@ -36,7 +36,4 @@ | ||
|
|
||
| const password = crypto | ||
| .createHmac('sha256', process.env.KUBERO_SESSION_KEY) | ||
| .update(pass) | ||
| .digest('hex'); | ||
| if (user.password === password) { | ||
| const passwordMatch = await bcrypt.compare(pass, user.password); | ||
| if (passwordMatch) { | ||
| const { password, ...result } = user; |
| ); | ||
| password = crypto | ||
| .createHmac('sha256', process.env.KUBERO_SESSION_KEY) | ||
| .update(password) |
Check failure
Code scanning / CodeQL
Use of password hash with insufficient computational effort High
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix AI 24 days ago
To fix the problem, we should replace the use of crypto.createHmac('sha256', ...) with a more secure password hashing scheme such as bcrypt. This will ensure that the password hashing process requires significant computational effort, making it more resistant to brute-force attacks.
The best way to fix the problem without changing existing functionality is to use the bcrypt library to hash the passwords. We will need to import the bcrypt library, update the password hashing logic to use bcrypt.hashSync, and ensure that the salt is properly generated and used.
| @@ -3,3 +3,3 @@ | ||
| dotenv.config(); | ||
| import * as crypto from 'crypto'; | ||
| import * as bcrypt from 'bcrypt'; | ||
|
|
||
| @@ -45,6 +45,4 @@ | ||
| ); | ||
| password = crypto | ||
| .createHmac('sha256', process.env.KUBERO_SESSION_KEY) | ||
| .update(password) | ||
| .digest('hex'); | ||
| const saltRounds = 10; | ||
| password = bcrypt.hashSync(password, saltRounds); | ||
| } |
Description
Fixes # (issue)
Type of change
How Has This Been Tested?
Test Configuration:
Checklist: