Password salts

[florian-klemt]

Hi everyone,

I was wondering if passwords are salted by default. I don't see anything like that, so I presume no, but wanted to check first.

[MrLeebo]

Yes, they are salted.

blitz/packages/blitz-auth/src/server/secure-password.ts

Line 12 in fb232d1

const hashedBuffer = await SP().hash(Buffer.from(password))

the hash() function of secure-password applies the salt.

[florian-klemt]

Ok, great 👍🏼
Just out of curiosity, shouldn't the salt be also stored in the db? How does it work in detail?

[MrLeebo]

They're both stored sequentially in the same field. Essentially, it is this:

byteArray = [...salt, ...hash]

The db field is a byte array, the first 16 bytes are the salt. The remaining bytes are the password hash.

[florian-klemt]

Thank you very much