Conversation
Added additional supported method for importing passwords.
|
Caution Review failedThe pull request is closed. WalkthroughThis pull request updates the documentation for bulk user import in Kinde, focusing on password hashing and security. The changes introduce support for Changes
Possibly related PRs
Suggested reviewers
Poem
📜 Recent review detailsConfiguration used: CodeRabbit UI 📒 Files selected for processing (1)
Thank you for using CodeRabbit. We offer it for free to the OSS community and would appreciate your support in helping us grow. If you find it useful, would you consider giving us a shout-out on your favorite social media? 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
Deploying kinde-docs-previews with
|
| Latest commit: |
431eecb
|
| Status: | ✅ Deploy successful! |
| Preview URL: | https://faf02abc.kinde-docs-previews.pages.dev |
| Branch Preview URL: | https://feat-hashed-passwords.kinde-docs-previews.pages.dev |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🧹 Nitpick comments (3)
src/content/docs/manage-users/add-and-edit/import-users-in-bulk.mdx (3)
102-104: Enhance salt-related documentation with examplesThe salt-related fields are well-defined but would benefit from concrete examples to aid implementation.
Consider adding examples:
- `salt` - extra characters added to passwords to make them stronger - `salt_position` - position of salt in password string. E.g. prefix (before) or suffix (after). - `salt_format` - format of the salt, e.g. hex, string, etc. + `salt` - extra characters added to passwords to make them stronger (e.g., "x4vF9") + `salt_position` - position of salt in password string: "prefix" (salt + password) or "suffix" (password + salt) + `salt_format` - format of the salt: "hex" for hexadecimal (e.g., "6164616D") or "string" for plain text🧰 Tools
🪛 LanguageTool
[style] ~102-~102: Consider using a shorter alternative to avoid wordiness.
Context: ... extra characters added to passwords to make them stronger -salt_position- position of salt in...(MADE_IT_JJR)
106-110: Clarify bcrypt variant compatibilityThe bcrypt variant note should be expanded to cover all common variants for completeness.
Consider adding information about other variants:
<Aside title="bcrypt $2b variant support:"> - Please note if you are importing bcrypt hashes with the $2b variant, Kinde will substitute this for the $2a variant. These are interchangeable as long as you were not running OpenBSD at the time the hashes were generated. + Please note if you are importing bcrypt hashes with the $2b variant, Kinde will substitute this for the $2a variant. Common bcrypt variants include: + - $2a$ - The original bcrypt algorithm (supported) + - $2b$ - Minor update to fix a wrap-around bug (automatically converted to $2a) + - $2y$ - Format used by PHP (not currently supported) + + Note: The $2b to $2a conversion is safe unless the hashes were specifically generated on OpenBSD. </Aside>
124-124: Enhance hashing method table with security informationThe table should include security recommendations to help users make informed decisions.
Consider expanding the table:
- | Hashing method | Salt | Salt position | - | -------------- | -------- | ------------------------- | - | md5 | Optional | required if salt included | - | bcrypt | | | - | crypt | Optional | | - | wordpress | Optional | | - | sha256 | Optional | required if salt included | + | Hashing method | Salt | Salt position | Security Level | Recommendation | + | -------------- | -------- | ------------------------- | -------------- | -------------- | + | bcrypt | | | High | Recommended | + | sha256 | Optional | required if salt included | Medium-High | Use with salt | + | crypt | Optional | | Medium | Legacy only | + | wordpress | Optional | | Medium | Legacy only | + | md5 | Optional | required if salt included | Low | Not recommended|
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (1)
src/content/docs/manage-users/add-and-edit/import-users-in-bulk.mdx(1 hunks)
🧰 Additional context used
🪛 LanguageTool
src/content/docs/manage-users/add-and-edit/import-users-in-bulk.mdx
[uncategorized] ~101-~101: A comma may be missing after the conjunctive/linking adverb ‘Currently’.
Context: ...hm used to encrypt the user’s password. Currently crypt, bcrypt, sha256, **md...
(SENT_START_CONJUNCTIVE_LINKING_ADVERB_COMMA)
[style] ~102-~102: Consider using a shorter alternative to avoid wordiness.
Context: ... extra characters added to passwords to make them stronger - salt_position - position of salt in...
(MADE_IT_JJR)
| <Aside title="sha256 support:"> | ||
|
|
||
| Provide the hash in hex format. Import the salt using the `salt` column. For the `salt_format`, specify how the salt should be interpreted: e.g. **hex** for a hex-encoded string (68656c6c6f for hello). By default, the salt is treated as a plain string, and escape sequences (like \n or \v) are treated as literal characters. | ||
|
|
||
| </Aside> |
There was a problem hiding this comment.
🛠️ Refactor suggestion
Add SHA256 implementation examples
The SHA256 documentation should include specific examples of hash generation and salt combination.
Consider adding implementation details:
<Aside title="sha256 support:">
- Provide the hash in hex format. Import the salt using the `salt` column. For the `salt_format`, specify how the salt should be interpreted: e.g. **hex** for a hex-encoded string (68656c6c6f for hello). By default, the salt is treated as a plain string, and escape sequences (like \n or \v) are treated as literal characters.
+ SHA256 implementation details:
+ 1. Hash format: Provide the hash in lowercase hex format (64 characters)
+ 2. Salt handling:
+ - For prefix salt: SHA256(salt + password)
+ - For suffix salt: SHA256(password + salt)
+
+ Example:
+ ```csv
+ email,hashed_password,hashing_method,salt,salt_position,salt_format
+ user@example.com,5e884898da28047151d0e56f8dc6292773603d0d6aabbdd62a11ef721d1542d8,sha256,mysalt,suffix,string
+ ```
+ This example represents: SHA256("password" + "mysalt")
</Aside>|
|
||
| - `hashed_password` - the user’s password encrypted using a hashing method or algorithm. | ||
| - `hashing_method` - the name of the algorithm used to encrypt the user’s password. Currently **crypt**, **bcrypt**, **md5**, and **wordpress** are supported. [Contact us](https://kinde-21631392.hs-sites.com/en-au/feature-request) if you need a different method. | ||
| - `hashing_method` - the name of the algorithm used to encrypt the user’s password. Currently **crypt**, **bcrypt**, **sha256**, **md5**, and **wordpress** are supported. [Contact us](https://kinde-21631392.hs-sites.com/en-au/feature-request) if you need a different method. |
There was a problem hiding this comment.
🛠️ Refactor suggestion
Add security recommendations for hashing methods
While the documentation accurately lists the supported hashing methods, it should include security recommendations to guide users toward more secure choices.
Consider reordering the methods by security strength and adding a security note:
-Currently **crypt**, **bcrypt**, **sha256**, **md5**, and **wordpress** are supported.
+Currently supported hashing methods (ordered by security strength):
+- **bcrypt** (recommended)
+- **sha256** with salt
+- **crypt**
+- **wordpress**
+- **md5** (not recommended for new implementations due to known vulnerabilities)📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| - `hashing_method` - the name of the algorithm used to encrypt the user’s password. Currently **crypt**, **bcrypt**, **sha256**, **md5**, and **wordpress** are supported. [Contact us](https://kinde-21631392.hs-sites.com/en-au/feature-request) if you need a different method. | |
| - `hashing_method` - the name of the algorithm used to encrypt the user's password. Currently supported hashing methods (ordered by security strength): | |
| - **bcrypt** (recommended) | |
| - **sha256** with salt | |
| - **crypt** | |
| - **wordpress** | |
| - **md5** (not recommended for new implementations due to known vulnerabilities) | |
| [Contact us](https://kinde-21631392.hs-sites.com/en-au/feature-request) if you need a different method. |
🧰 Tools
🪛 LanguageTool
[uncategorized] ~101-~101: A comma may be missing after the conjunctive/linking adverb ‘Currently’.
Context: ...hm used to encrypt the user’s password. Currently crypt, bcrypt, sha256, **md...
(SENT_START_CONJUNCTIVE_LINKING_ADVERB_COMMA)
oliwolff1
left a comment
oliwolff1
left a comment
There was a problem hiding this comment.
I can't comment on whether the content is good - I think someone who knows SHA256 would need to comment on this - but it looks good to me.
I will approve for now
|
@clairekinde11 - looks like you need to update tables in the following docs too:
Need to confirm with David if change made was also made to support SHA256 for setting password (or temp password) via API
Changing from not approved |
oliwolff1
left a comment
oliwolff1
left a comment
There was a problem hiding this comment.
@clairekinde11 - looks like you need to update tables in the following docs too:
- https://feat-hashed-passwords.kinde-docs-previews.pages.dev/get-started/switch-to-kinde/switch-to-kinde-for-user-authentication/ (i.e. https://docs.kinde.com/get-started/switch-to-kinde/switch-to-kinde-for-user-authentication/?r=search#password-data-optional)
Need to confirm with David if change made was also made to support SHA256 for setting password (or temp password) via API
- https://feat-hashed-passwords.kinde-docs-previews.pages.dev/manage-users/access-control/set-temporary-password/?r=search#set-or-update-a-password-via-kinde-api (i.e. https://docs.kinde.com/manage-users/access-control/set-temporary-password/?r=search#set-or-update-a-password-via-kinde-api)
We can make this separate change in a following PR once we hear back from David.
3 participants
Added additional supported method for importing passwords.
Summary by CodeRabbit
New Features
sha256.salt,salt_position, andsalt_format.Documentation
sha256hashes.