Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

add hashAlgorithm to options; move hash to object instance property #16

Open
wants to merge 2 commits into
base: master
Choose a base branch
from

Conversation

buzcarter
Copy link

No description provided.

@buzcarter
Copy link
Author

A security pal pointed out that sha1 has myriad security concerns, was asked to use a different algorithm.

Fortunately, it's an easy task to extend the initialization options to include a hashAlgorithm property (that we default to "sha1" for backwards compatibility)

Node crypto supports anything available in its native OS : https://nodejs.org/api/crypto.html#crypto_crypto_createhash_algorithm_options

The algorithm is dependent on the available algorithms supported by the version of OpenSSL on the platform. Examples are 'sha256', 'sha512', etc.

@buzcarter buzcarter force-pushed the feature/crypto-hash-algorithm-option branch from 2cc630a to cf459a7 Compare September 11, 2019 18:18
@@ -148,9 +163,9 @@ Tokens.prototype.verify = function verify (secret, token) {
* @private
*/

function hash (str) {
Tokens.prototype.hash = function hash (str) {
Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

this is the biggest change: moving this method from a private "helper" to a public class method, all necessitated by needing access to this.hashAlgorithm.

Is the naming convention to prepend an underscore to indicate private? (which would be great, IMHO -- _hash)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

1 participant