13.0.0 Release Notes

[hueniverse]

Summary

hapi v13.0.0 is a tiny release with a single change to ensure passwords passed internally to the iron module are sufficiently long (a new minimum length of 32 characters). This release will simply assert if short passwords are passed. This is a critical verification as short password are easy to exploit with a brute force.

• Upgrade time: low - no time to a couple of hours for most users
• Complexity: low - potentially requires increasing password string length
• Risk: low - low risk of side effects and no changes to keep track of overall
• Dependencies: low- applies to a single API call

Thanks to @tomsteele for his help with this release.

Sponsor

The v13.0.0 major release is sponsored by Sideway.

Breaking Changes

• Requires passwords used to encrypt or sign cookies to be at least 32 character long.

New Features

None.

Bug fixes

None.

Updated dependencies

• iron from v3.0.1 to v4.0.0
• statehood from v3.1.0 to v4.0.0

Migration Checklist

Password length

The new requirement will cause invalid configurations to fail with an error that the password string is too short. This is a good thing - you want it to fail because if your password is indeed too short, you are at real risk of being exploited. Because the internal encryption mechanism uses the pbkdf2 algorithm with a single iteration to generate the keys, it is a pretty quick operation. Because the method is called on every incoming request, increasing the iteration count would have a linear negative impact on performance. To avoid that, a long password creates far too many possible password combination for an attacker to try in a timely manner.

Checklist:

• Check your code for calls to server.state() or connection state configuration for password or sign.password and if present ensure you are passing a string that is at least 32 characters long.

[rluba]

The corresponding tag is not yet pushed. Might also be the reason for #3041?

[hueniverse]

My vm died while I was away so it probably failed at the end of the publish script. Fixed now. thanks.