diff --git a/.changeset/fluffy-baboons-relax.md b/.changeset/fluffy-baboons-relax.md new file mode 100644 index 00000000000..3e1ef18aa93 --- /dev/null +++ b/.changeset/fluffy-baboons-relax.md @@ -0,0 +1,5 @@ +--- +'@keystonejs/auth-password': patch +--- + +Made simulated password self-documenting. diff --git a/packages/auth-password/index.js b/packages/auth-password/index.js index ce04fac5acb..62e160d109e 100644 --- a/packages/auth-password/index.js +++ b/packages/auth-password/index.js @@ -75,7 +75,9 @@ class PasswordAuthStrategy { // TODO: This should call `secretFieldInstance.compare()` to ensure it's // always consistent. // This may still leak if the workfactor for the password field has changed - const hash = await secretFieldInstance.generateHash('password1234'); + const hash = await secretFieldInstance.generateHash( + 'simulated-password-to-counter-timing-attack' + ); await secretFieldInstance.compare('', hash); return { success: false, message: '[passwordAuth:failure] Authentication failed' }; } @@ -108,7 +110,9 @@ class PasswordAuthStrategy { }; } - const hash = await secretFieldInstance.generateHash('password1234'); + const hash = await secretFieldInstance.generateHash( + 'simulated-password-to-counter-timing-attack' + ); await secretFieldInstance.compare(secret, hash); return { success: false,