feat: add optional token hashing #25982

gwossum · 2025-02-06T21:30:48Z

Add optional token hashing with --use-hashed-tokens command line option.

davidby-influx

A variety of smaller issues. I will need to review this again to fully understand the larger changes.

authorization/hasher.go

authorization/http_server_test.go

testing/onboarding.go

authorizer/task_test.go

cmd/influxd/recovery/auth/auth.go

davidby-influx

My usual add more context to error and log messages and a few more substantive questions and suggestions

authorization/hasher.go

authorization/http_server_test.go

authorization/storage_authorization.go

cmd/influxd/recovery/auth/auth.go

testing/onboarding.go

davidby-influx

All changes pertain to comments, but important one is whether to delete or include a commented out code section

authorization/storage_authorization_test.go

cmd/influxd/recovery/auth/auth.go

devanbenz

Just a few comments mostly about extra safety checks and some error messaging. I've been able to get about half way through the PR. Going to step away for a minute to take a little brain break and then finish up the rest of the PR for my first pass.

authorization/hasher.go

authorization/http_server_test.go

authorization/storage.go

authorization/storage_authorization.go

devanbenz

Adding a few more comments to storage_authorization.go I noticed that a bunch of my comments for the require.NoError(..) is similar to what david commented so my apologies for that :P

authorization/storage_authorization.go

devanbenz

Adding in a few more comments

authorizer/task_test.go

cmd/influxd/recovery/auth/auth.go

cmd/influxd/recovery/testhelper/influxd.bolt.testdata

cmd/influxd/upgrade/security_test.go

devanbenz

Going to pick back up my review next week for a second pass. Consider this first pass finished up.

cmd/influxd/upgrade/security_test.go

Dismissing

devanbenz

Finished reading through this code, everything looks fine to me after that pass. Please let me know when you merge in main and require a second look over.

gwossum · 2025-08-25T22:55:02Z

Claude's analysis of potential information leakage in error messages:

  With the understanding that only system administrators have log access, there is essentially NO information leakage risk from error messages in this implementation.

  Why No Risk

  1. Administrators are trusted: System admins already have:
    - Direct database access
    - Ability to view/modify all authorizations
    - Access to configuration and secrets
    - Root/administrative system access
  2. Logs need debugging detail: For administrators, detailed error messages are beneficial, not risky:
    - They need to diagnose issues quickly
    - Token IDs and descriptions help identify problematic authorizations
    - Hash variant information aids in migration troubleshooting
  3. No sensitive data logged: Even for admins, the code correctly:
    - Never logs actual token values
    - Never logs hashed token values
    - Only logs operational metadata

  Current Error Messages Are Appropriate

  Examples like:
  - "error hashing token for token %d (%s): %w" - Helps admins identify which token failed
  - "found authorization without any token set during hashed token migration" - Alerts admins to data integrity issues
  - "hashing raw token failed (variant=%s): %w" - Helps debug algorithm configuration issues

  These provide exactly the right level of detail for administrative troubleshooting.

  Final Assessment

  Information leakage risk: NONE

  The error messages are appropriately designed for their audience (system administrators) and contain no sensitive information. The implementation correctly balances:
  - Detailed internal errors for admin debugging
  - Generic external errors for security
  - No logging of actual sensitive values

  No changes needed - the error handling is well-implemented for a production system.

devanbenz

Leaving two comments, still finishing up the review.

authorization/storage.go

pkg/crypt/algorithm/influxdb2/hasher.go

davidby-influx

A few remaining suggestions. What a huge amount of work!

authorization/storage.go

authorization/storage_authorization.go

authorization/storage_authorization_test.go

davidby-influx · 2025-08-28T03:41:00Z

cmd/influxd/recovery/auth/auth.go

Just a general question: do we have context for all the startup errors?

Opening the KV store

NewAuthorizationHasher

authorization.NewStore

etc.

It took a while, but I think there's good context for everything in authorization/authorization.goand authorization/storage_authorization.go

devanbenz · 2025-11-17T16:14:17Z

I tested everything locally and it all seems fine. I did notice, as outlined by your comment here: https://github.com/influxdata/influxdb/pull/25982/files#diff-05dfd885ddd66163be3e6ac7416f3b6326f186d236cba26153bd790bc93c880dR51, that starting up influxd without --use-hashed-tokens does lead to new tokens not being hashed. Do you think it would be beneficial to add some sort of warning log or info log upon token creation or startup if there are already hashed tokens? Just informing the user that influxd may not be running with token hashing enabled when it was previously enabled?

gwossum · 2025-11-19T18:20:18Z

I tested everything locally and it all seems fine. I did notice, as outlined by your comment here: https://github.com/influxdata/influxdb/pull/25982/files#diff-05dfd885ddd66163be3e6ac7416f3b6326f186d236cba26153bd790bc93c880dR51, that starting up influxd without --use-hashed-tokens does lead to new tokens not being hashed. Do you think it would be beneficial to add some sort of warning log or info log upon token creation or startup if there are already hashed tokens? Just informing the user that influxd may not be running with token hashing enabled when it was previously enabled?

During normal operation, there is no way to "downgrade" a hashed token, so there is no need to log about unhashing a token. On startup, the hashed token can not be unhashed because hashes are one-way. When a token is used, there is no attempt to store it as unhashed, even though this could be added. The only way to update a token is by sending a PATCH request to v2/authorizations, which does not allow changing the actual token value. Because of this, when an update is performed the at-rest storage of the token (hashed vs unhashed) can not be changed.

I think logging on startup that hashed tokens exist but hashed tokens are disabled is a good idea, though.

philjb · 2025-11-19T19:39:50Z

I'd be ok with using a helper for all the auth.Token != "" and auth.HashedToken != "" != "" checks.

if tokenUnset(auth.HashedToken) {

func tokenUnset(t string) bool {
    return t == ""
}

not essential, but the code makes assumptions about what the empty string means -- there's a comment about it so it is essentially a special type of token: an "unset one".

philjb

initial comments

philjb · 2025-11-19T19:00:22Z

authorization/storage.go

+Additionally, raw tokens are automatically migrated to hashed tokens if `--use-hashed-tokens` is configured.
+Due to the schema changes, to use a version of InfluxDB without hashed token support, a manual downgrade using
+`influxd downgrade` must be run. Any tokens stored as hashed tokens will be unusable by the old version of InfluxDB
+and must be reset or recreated.


worth while to mention "or restored from an independent backup" ? or something like that?

authorization/storage.go

pkg/crypt/algorithm/influxdb2/digest.go

authorization/storage_authorization.go

authorization/http_server.go

authorization/storage.go

gwossum · 2025-11-19T20:56:13Z

I'd be ok with using a helper for all the auth.Token != "" and auth.HashedToken != "" != "" checks.

if tokenUnset(auth.HashedToken) {
func tokenUnset(t string) bool {
    return t == ""
}```

not essential, but the code makes assumptions about what the empty string means -- there's a comment about it so it is essentially a special _type_ of token: an "unset one". 

That's a good idea. I'll go ahead and implement it.

philjb · 2025-11-19T21:08:02Z

cmd/influxd/launcher/cmd.go

+			DestP:   &o.UseHashedTokens,
+			Flag:    "use-hashed-tokens",
+			Default: o.UseHashedTokens,
+			Desc:    "enable token hashing",


so terse it borders on inaccurate for everything this flag controls.

How about enable storing hashed API tokens on disk (improves security, but prevents downgrades to < 2.8)?

cmd/influxd/launcher/launcher.go

testing/auth.go

pkg/crypt/algorithm/influxdb2/decoder.go

Add optional token hashing with `--use-hashed-tokens` command line option.

Create duplicate tokens from being created. This is a bug introduced earlier in this PR. Also improve tests so they detect the bug and use testify throughout.

Fix a bug that only allowed hashed tokens to be looked up if they used the currently active hashing algorithm. Also added tests for configuration migration scenarios (enabling and disabling hashing, changing hashing scheme).

Address PR issues on comments, error handling, and add final token matching check in `Store.GetAuthorizationByToken`.

Changes in addition to minor cleanups: - `authentication.Store` can now log info and warnings - Improved logic in `UpdateAuthorization` when both Token and HashedToken are set. Added supporting test cases.

Add tests for misuses of NewAuthorizationHasher and improve an error message.

Update outdated comment regarding PHC format attack.

- In Store.autogenerateHasher, avoid modifying foundVariants. - Improve comment for Hasher.HashWithSalt

Also add some clarifying comments.

- Removed `authResponse.HashedToken` field - Improved error messages, log messages, and comments - Improved error propagation - Improve description of `--use-hashed-tokens` command line parameter - Removed dead code - Implemented test to make sure hashed version of tokens can not be presented for authentication

pkg/crypt/algorithm/influxdb2/digest.go

philjb

LGTM

gwossum added kind/feature area/2.x OSS 2.0 related issues and PRs labels Feb 6, 2025

gwossum self-assigned this Feb 6, 2025

gwossum mentioned this pull request Feb 6, 2025

feat: add optional token hashing #25979

Closed

davidby-influx requested changes Feb 10, 2025

View reviewed changes

davidby-influx requested changes Feb 20, 2025

View reviewed changes

davidby-influx requested changes Feb 25, 2025

View reviewed changes

gwossum force-pushed the gw/edge306/token_hashing branch from 15f8e92 to 6aa2d1a Compare February 25, 2025 21:42

devanbenz requested changes Feb 26, 2025

View reviewed changes

devanbenz reviewed Feb 27, 2025

View reviewed changes

authorization/storage_authorization.go Show resolved Hide resolved

authorization/storage_authorization.go Show resolved Hide resolved

authorization/storage_authorization.go Show resolved Hide resolved

devanbenz reviewed Feb 27, 2025

View reviewed changes

devanbenz previously approved these changes Feb 28, 2025

View reviewed changes

cmd/influxd/upgrade/security_test.go Show resolved Hide resolved

devanbenz self-requested a review February 28, 2025 19:00

devanbenz reviewed Jul 21, 2025

View reviewed changes

gwossum force-pushed the gw/edge306/token_hashing branch from a3c28e7 to fc74353 Compare July 23, 2025 22:43

devanbenz reviewed Aug 27, 2025

View reviewed changes

authorization/storage.go Outdated Show resolved Hide resolved

pkg/crypt/algorithm/influxdb2/hasher.go Outdated Show resolved Hide resolved

davidby-influx requested changes Aug 28, 2025

View reviewed changes

philjb reviewed Nov 19, 2025

View reviewed changes

authorization/http_server.go Outdated Show resolved Hide resolved

philjb reviewed Nov 19, 2025

View reviewed changes

authorization/storage.go Show resolved Hide resolved

philjb reviewed Nov 19, 2025

View reviewed changes

cmd/influxd/launcher/launcher.go Outdated Show resolved Hide resolved

philjb reviewed Nov 19, 2025

View reviewed changes

testing/auth.go Outdated Show resolved Hide resolved

philjb reviewed Nov 19, 2025

View reviewed changes

pkg/crypt/algorithm/influxdb2/decoder.go Outdated Show resolved Hide resolved

gwossum added 22 commits November 20, 2025 13:39

feat: add optional token hashing

342023b

Add optional token hashing with `--use-hashed-tokens` command line option.

chore: rollback changes to v1/authorization

f45372d

chore: fix static check issues, take advantage of go1.23 feature

226b492

chore: replace deprecated call

32ff23b

fix: prevent duplicate tokens from being created

2cb148b

Create duplicate tokens from being created. This is a bug introduced earlier in this PR. Also improve tests so they detect the bug and use testify throughout.

chore: variety of minor fixes

c40e0cf

Address PR issues on comments, error handling, and add final token matching check in `Store.GetAuthorizationByToken`.

chore: improve comments, error handling, logging, and edge cases

997e38f

Changes in addition to minor cleanups: - `authentication.Store` can now log info and warnings - Improved logic in `UpdateAuthorization` when both Token and HashedToken are set. Added supporting test cases.

chore: fix spelling and grammar mistakes, remove dead code

d530327

chore: address comments from PR

eaa140d

chore: add tests for misuses of NewAuthorizationHasher

0b61c32

Add tests for misuses of NewAuthorizationHasher and improve an error message.

chore: turn some user-facing string literals into constants

c06e7bb

chore: add context to test cases

5494e24

chore: update outdated comment

d473f24

Update outdated comment regarding PHC format attack.

fix: remove timing attack when comparing raw tokens

ad62021

chore: code improvements

a6b9cb9

- In Store.autogenerateHasher, avoid modifying foundVariants. - Improve comment for Hasher.HashWithSalt

chore: fix flaky test

18ec84a

chore: address PR comments

339ee6d

fix: use constant time comparison when checking for unhashed tokens

5988c96

feat: add logging if hashing disabled but hashed tokens found

5e88aff

chore: abstract checking if tokens are clear or set for readability

19a4057

Also add some clarifying comments.

gwossum force-pushed the gw/edge306/token_hashing branch from f35ac5b to d1b3e1b Compare November 20, 2025 19:41

gwossum marked this pull request as ready for review November 20, 2025 19:42

philjb reviewed Nov 20, 2025

View reviewed changes

pkg/crypt/algorithm/influxdb2/digest.go Show resolved Hide resolved

philjb approved these changes Nov 20, 2025

View reviewed changes

gwossum merged commit b74507b into main-2.x Nov 20, 2025
25 checks passed

gwossum deleted the gw/edge306/token_hashing branch November 20, 2025 20:18

philjb mentioned this pull request Nov 21, 2025

[2.x oss] Bucket retention policy doesn't change back to "never" #23049

Open

davidby-influx linked an issue Nov 21, 2025 that may be closed by this pull request

Operator Token Privilege Escalation #24797

Open

feat: add optional token hashing #25982

feat: add optional token hashing #25982

Uh oh!

Conversation

gwossum commented Feb 6, 2025

Uh oh!

davidby-influx left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

davidby-influx left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

davidby-influx left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

devanbenz left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

devanbenz left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

devanbenz left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

devanbenz left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

devanbenz left a comment

Choose a reason for hiding this comment

Uh oh!

gwossum commented Aug 25, 2025

Uh oh!

devanbenz commented Nov 17, 2025 •

edited

Loading

philjb commented Nov 19, 2025 •

edited

Loading