New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[auth] add salt to session id cipher #22

Open

rt2zz opened this issue Feb 16, 2018 · 1 comment

Member

rt2zz commented Feb 16, 2018

right now we just encrypt it, which means the cipher never changes https://github.com/async-la/thin-auth/blob/master/packages/server/src/scope/auth/index.js#L191

Do we need a salt here? security wise I am unsure, but it guarantees equal or better security so I suggest we add it.

Member Author

rt2zz commented Feb 16, 2018

note: probably doesnt make sense because this is two way encryption, not hashing

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment