After reviewing the documentation, I realized that the specific details are not mentioned. I am unsure about delving into the source code to understand this. However, it seems like a feasible solution.
I am currently facing the challenge of transferring a moderate-sized database containing username/password data from Spring framework to Remix.js.
The main obstacle I'm encountering lies in correctly salting passwords with hashing algorithms. I foresee having to experiment with various combinations, so I thought I'd seek some advice.
Here is an example of how the old hashes are generated: https://github.com/Parrit/Parrit/blob/master/src/main/java/com/parrit/controllers/ProjectController.java#L68
and here is a sample hash. In plaintext, this should be password
{sha256}{1htkE/1MXKL7uqfqhOC2SI39YzX2lEsd96BqJCHTUCs=}9f62dbe07df8ac7f049cdb1ae1291b02f2d1ea645c7f4df9a1235e93a0f213bd
My understanding is that this format represents {alg}{salt}hash
However, I encountered a mismatch when attempting to compute a hash in JavaScript
const compare_sha256 = (attempt: string, info: PasswordInfo): boolean => {
let attemptHash;
if (info.salt) {
const saltedAttempt = attempt + info.salt;
console.log("saltedAttempt", saltedAttempt);
attemptHash = createHash("sha256").update(saltedAttempt).digest("hex");
} else {
attemptHash = createHash("sha256").update(attempt).digest("hex");
}
console.log({ attemptHash, actuallHash: info.hash });
return attemptHash === info.hash;
};
Upon logging:
saltedAttempt password1htkE/1MXKL7uqfqhOC2SI39YzX2lEsd96BqJCHTUCs=
{
attemptHash: 'ae192cbdfa2abf7b82bfdeec0168cc0cd7fd359ed49d7494daa88046ef025599',
actuallHash: '9f62dbe07df8ac7f049cdb1ae1291b02f2d1ea645c7f4df9a1235e93a0f213bd'
}
I suspect there must be a delimiter separating the plaintext and salt. If I have overlooked something, please point it out to me.