You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Is your feature request related to a problem? Please describe.
Currently, passwords are transformed by the EncryptionTransformer which is provided by the typeorm-encrypted package:
Encryption works two-way: Anything that is encrypted can be decrypted if the decryption key is known. In the case of storing user passwords of a web app, the operator of the web app (administrators, developers or similar) is able to decrypt the passwords of the users and read them. As internet users tend to use the same password for multiple websites, the operator of the web app could exploit this and use the login data (username and password) of the user for example to buy things in an online shop. Therefore, it is desirable that the operators of the web app are unable to decrypt the password. This can be achieved by using a one-way mechanism to obfuscate the password (hashing) instead. If this is the case, the password is transformed by the hashing algorithm before storing it to the database. When the user tries to log in, the entered password is transformed the same way and the hashed passwords are compared.
The NestJS docs suggest using this method: https://docs.nestjs.com/security/authentication
This method is also considered best practise for web apps: https://cloud.google.com/blog/products/identity-security/account-authentication-and-password-management-best-practices https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html#background
Is your feature request related to a problem? Please describe.
Currently, passwords are transformed by the EncryptionTransformer which is provided by the typeorm-encrypted package:
generator-jhipster-nodejs/generators/server/templates/server/src/domain/user.entity.ts.ejs
Line 33 in 058b1da
Encryption works two-way: Anything that is encrypted can be decrypted if the decryption key is known. In the case of storing user passwords of a web app, the operator of the web app (administrators, developers or similar) is able to decrypt the passwords of the users and read them. As internet users tend to use the same password for multiple websites, the operator of the web app could exploit this and use the login data (username and password) of the user for example to buy things in an online shop. Therefore, it is desirable that the operators of the web app are unable to decrypt the password. This can be achieved by using a one-way mechanism to obfuscate the password (hashing) instead. If this is the case, the password is transformed by the hashing algorithm before storing it to the database. When the user tries to log in, the entered password is transformed the same way and the hashed passwords are compared.
The NestJS docs suggest using this method: https://docs.nestjs.com/security/authentication
This method is also considered best practise for web apps:
https://cloud.google.com/blog/products/identity-security/account-authentication-and-password-management-best-practices
https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html#background
Describe the solution you'd like
I would suggest replacing the
EncryptionTransformer
by a newly introducedHashTransformer
which also implements the ValueTransformer interface. This transformer should use bcrypt (https://codahale.com/how-to-safely-store-a-password/)However, ValueTransformers do not support async operations whilst it is recommended to use bcrypt's async method. Therefore this should not be implemented via a ValueTransformer but via TypeORM Entity Listeners instead.
The text was updated successfully, but these errors were encountered: