Skip to content

Conversation

@tarcieri
Copy link
Member

@tarcieri tarcieri commented Jan 9, 2023

Previously PasswordHash::hash_password and PasswordHash::generate took &str for Salt, however this is a bit of a confusing API because the first thing it does is attempt to convert to a Salt which upholds several invariants including "B64" encoding.

This change makes the Salt parameter explicit so it's clear what type is responsible for checking those invariants.

Closes #1029.

Previously `PasswordHash::hash_password` and `PasswordHash::generate`
took `&str` for `Salt`, however this is a bit of a confusing API because
the first thing it does is attempt to convert to a `Salt` which upholds
several invariants including "B64" encoding.

This change makes the `Salt` parameter explicit so it's clear what type
is responsible for checking those invariants.
@tarcieri tarcieri merged commit 18871f7 into master Jan 9, 2023
@tarcieri tarcieri deleted the password-hash/typed-salts branch January 9, 2023 01:57
@tarcieri tarcieri mentioned this pull request Mar 4, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

password-hash: unsafe salt API

2 participants