nuxt-auth-utils icon indicating copy to clipboard operation
nuxt-auth-utils copied to clipboard

Password hash should use Argon and be usable without Nuxt context

Open tobiasdiez opened this issue 1 year ago • 1 comments

The password hashing currently uses scrpyt, with no way to change this. But Argon2 is recommended nowadays for hashing of passwords, so I think this should be the default.

Moreover, it would be nice if the password methods could be exposed, say via nuxt-auth-utils/password so that one can use them eg in tests or other contexts where nuxt is not available (eg seeding in a db). For this, maybe extract the useRuntimeConfig call and pass the config as a parameter. Alternatively, use tryUseNuxtApp to check if a nuxt app is available and only then query the runtime config.

tobiasdiez avatar Oct 03 '24 03:10 tobiasdiez

I decided to go with scrypt for a reason, it works on all JS runtime nowaday, once Argon2 will be supported, I will switch to it.

In the meantime, you can always use argon2 yourself.

For exporting the utils, I think if can be a good idea yes.

atinux avatar Oct 04 '24 11:10 atinux