Skip to content

Conversation

buzcarter
Copy link

No description provided.

@buzcarter
Copy link
Author

A security pal pointed out that sha1 has myriad security concerns, was asked to use a different algorithm.

Fortunately, it's an easy task to extend the initialization options to include a hashAlgorithm property (that we default to "sha1" for backwards compatibility)

Node crypto supports anything available in its native OS : https://nodejs.org/api/crypto.html#crypto_crypto_createhash_algorithm_options

The algorithm is dependent on the available algorithms supported by the version of OpenSSL on the platform. Examples are 'sha256', 'sha512', etc.

@buzcarter buzcarter force-pushed the feature/crypto-hash-algorithm-option branch from 2cc630a to cf459a7 Compare September 11, 2019 18:18
@@ -148,9 +163,9 @@ Tokens.prototype.verify = function verify (secret, token) {
* @private
*/

function hash (str) {
Tokens.prototype.hash = function hash (str) {
Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

this is the biggest change: moving this method from a private "helper" to a public class method, all necessitated by needing access to this.hashAlgorithm.

Is the naming convention to prepend an underscore to indicate private? (which would be great, IMHO -- _hash)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant