npm package bcrypt compare function no need salt question All In One
npm package bcrypt compare function no need salt question All In One
Why bcrypt.compare function no need to use salt, when compare with origin password?
https://github.com/kelektiv/node.bcrypt.js/discussions/972
salt default 10
https://github.com/kelektiv/node.bcrypt.js/issues/963#issuecomment-1272338945
jwt signature
https://github.com/kelektiv/node.bcrypt.js/issues/935#issuecomment-1159411386
Per bcrypt implementation, only the first 72 bytes
of a string are used.
Any extra bytes are ignored
when matching passwords.
Note that this is not the first 72 characters.
It is possible for a string to contain less than
72 characters, while taking up more than
72 bytes
(e.g. a UTF-8
encoded string containing emojis
).
demo
{
"dependencies": {
"bcrypt": "3.0.6",
}
}
Why bcrypt.compare function no need to use salt, when compare with origin password?
// hash-salt-test.js
const bcrypt = require('bcrypt');
const hash = async function (password, salt = 10) {
// 默认值 10
console.log(`❓salt =`, salt);
const hashed = await bcrypt.hash(password, salt);
return hashed;
}
const check = async function (password, hashed) {
const result = await bcrypt.compare(password, hashed);
return result;
}
const test = async function (salt = 10) {
// password length is 10 ✅, less than 72 bytes ❓
const pwd = 'pwd1234567';
const hashed = await hash(pwd, salt);
const result = await check(pwd, hashed);
console.log(`\nhash with salt`, hashed);
console.log(`result =`, result);
}
test();
test(5);
test(11);
test(15);
test(17);
/*
$ node ./hash-salt-test.js
❓salt = 10
❓salt = 5
❓salt = 11
❓salt = 15
❓salt = 17
hash with salt $2b$05$.zICWxt0wAjGb58kIN6GwekMtP5jUeYD34/wqfE17yYqZ3rO43RV.
result = true
hash with salt $2b$10$PPJdjtaboGieRgk1p86bsuCHIqmiFhqaRGwHrpVs5/dZ3ZLC8b33m
result = true
hash with salt $2b$11$Y.Ozy9S5gtZUR1XD3egrGeZ1H8HmPOUqBDochpGM5pLCIP2tk38Xa
result = true
hash with salt $2b$15$UBGFkZRAxGgMMTaRDmxJ1eTgCBM.ovvESEyJJwrGeIpk/Vw3NPFkC
result = true
hash with salt $2b$17$zyjemy4KDsQDO8Q2kCgYeeW/FsG3kiWp0hXl4t.o8GUWrWjA4.R.S
result = true
*/
https://www.npmjs.com/package/bcrypt
https://github.com/kelektiv/node.bcrypt.js
https://github.com/nodejs/node-gyp
https://en.wikipedia.org/wiki/Bcrypt
js get string bytes
length
// js get string bytes length ✅
(() => {
const len = unescape(encodeURIComponent(`pwd1234567`)).length;
console.log(`bytes =`, len);
// 10
})();
// The signature '(string: string): string' of 'unescape' is deprecated.ts(6387)
(() => {
const len = new TextEncoder().encode(`pwd1234567`).length;
console.log(`bytes =`, len);
// 10
})();
// (() => {
// let size = new Blob(['pwd1234567']).size;
// console.log(`bytes =`, size);
// // 10
// })();
// Node.js v16 ❌ ReferenceError: Blob is not defined
// @since — v18.0.0
// https://nodejs.org/api/buffer.html#class-blob
(() => {
const bytes = Buffer.byteLength(`pwd1234567`, 'utf8');
console.log(`UTF-8 bytes =`, bytes);
// 10
})();
(() => {
const bytes = Buffer.byteLength(`pwd1234567`, 'utf16');
console.log(`UTF-16 bytes =`, bytes);
// 10
})();
https://www.cloudhadoop.com/string-size-bytes-javascript/
https://www.geeksforgeeks.org/how-to-get-the-length-of-a-string-in-bytes-in-javascript/
https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/String/length
JWT
JWT Handbook pdf download
https://cdn.xgqfrms.xyz/Handbook/JWT/jwt-handbook-v0_14_1.pdf
https://cdn.xgqfrms.xyz/Handbook/JWT/jwt-handbook-v0_14_1.epub
https://cdn.xgqfrms.xyz/Handbook/JWT/jwt-handbook-v0_14_1.mobi
https://www.cnblogs.com/xgqfrms/p/9712897.html#5132442
https://www.monterail.com/blog/more-secure-passwords-bcrypt
how to get a SHA-256 bit secret in a Linux terminal
https://man7.org/linux/man-pages/man1/sha256sum.1.html
https://www.computerhope.com/unix/sha256sum.htm
zsh: command not found: sha256sum
$ sha256sum jwt_token.md
zsh: command not found: sha256sum
$ brew install coreutils
Running `brew update --auto-update`...
==> Auto-updated Homebrew!
Updated 1 tap (homebrew/core).
==> New Formulae
brpc ghc@9.2 seven-kingdoms
cocogitto ibazel sql-language-server
gf jscpd
You have 1 outdated formula installed.
You can upgrade it with brew upgrade
or list it with brew outdated.
==> Downloading https://ghcr.io/v2/homebrew/core/gmp/manifests/6.2.1_1
######################################################################## 100.0%
==> Downloading https://ghcr.io/v2/homebrew/core/gmp/blobs/sha256:4c6488dfd53b82
==> Downloading from https://pkg-containers.githubusercontent.com/ghcr1/blobs/sh
######################################################################## 100.0%
==> Downloading https://ghcr.io/v2/homebrew/core/coreutils/manifests/9.1
######################################################################## 100.0%
==> Downloading https://ghcr.io/v2/homebrew/core/coreutils/blobs/sha256:45640090
==> Downloading from https://pkg-containers.githubusercontent.com/ghcr1/blobs/sh
######################################################################## 100.0%
==> Installing dependencies for coreutils: gmp
==> Installing coreutils dependency: gmp
==> Pouring gmp--6.2.1_1.ventura.bottle.tar.gz
🍺 /usr/local/Cellar/gmp/6.2.1_1: 21 files, 3.3MB
==> Installing coreutils
==> Pouring coreutils--9.1.ventura.bottle.tar.gz
==> Caveats
Commands also provided by macOS and the commands dir, dircolors, vdir have been installed with the prefix "g".
If you need to use these commands with their normal names, you can add a "gnubin" directory to your PATH with:
PATH="/usr/local/opt/coreutils/libexec/gnubin:$PATH"
==> Summary
🍺 /usr/local/Cellar/coreutils/9.1: 476 files, 13.5MB
==> Running `brew cleanup coreutils`...
Disable this behaviour by setting HOMEBREW_NO_INSTALL_CLEANUP.
Hide these hints with HOMEBREW_NO_ENV_HINTS (see `man brew`).
==> Caveats
==> coreutils
Commands also provided by macOS and the commands dir, dircolors, vdir have been installed with the prefix "g".
If you need to use these commands with their normal names, you can add a "gnubin" directory to your PATH with:
PATH="/usr/local/opt/coreutils/libexec/gnubin:$PATH"
➜ linux-shell-playground
$ PATH="/usr/local/opt/coreutils/libexec/gnubin:$PATH"
https://unix.stackexchange.com/questions/426837/no-sha256sum-in-macos
https://www.baeldung.com/linux/sha-256-from-command-line
https://www.ibm.com/docs/en/imdm/12.0?topic=encryption-generating-aes-keys-password
blogs
https://www.monterail.com/blog/more-secure-passwords-bcrypt
https://codahale.com/how-to-safely-store-a-password/
https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html
https://github.com/OWASP/CheatSheetSeries
https://github.com/web-full-stack/CheatSheetSeries/tree/master/cheatsheets
https://github.com/web-full-stack/CheatSheetSeries/issues/1
(🐞 反爬虫测试!打击盗版⚠️)如果你看到这个信息, 说明这是一篇剽窃的文章,请访问 https://www.cnblogs.com/xgqfrms/ 查看原创文章!
refs
https://www.cnblogs.com/xgqfrms/p/9712897.html#5132441
https://www.cnblogs.com/xgqfrms/p/9712897.html#5132442
©xgqfrms 2012-2021
www.cnblogs.com/xgqfrms 发布文章使用:只允许注册用户才可以访问!
原创文章,版权所有©️xgqfrms, 禁止转载 🈲️,侵权必究⚠️!
本文首发于博客园,作者:xgqfrms,原文链接:https://www.cnblogs.com/xgqfrms/p/16970023.html
未经授权禁止转载,违者必究!