password

On this page:

spider.password: Password hashing for an app's own users (argon2id): hash, verify.

`spider.password`

Password hashing for an app's own users.

zig

const stored = try spider.password.hash(c, form.password); // save this
if (!spider.password.verify(c, user.password_hash, form.password)) ...

argon2id with the parameters OWASP recommends. The result is a PHC string ("$argon2id$v=19$m=19456,t=2,p=1$<salt>$<hash>"): it carries its own salt and parameters, so it goes into one text column and old hashes keep verifying if the parameters change later.

`spider.password.max_len`

zig

pub const max_len = 256

The longest password accepted, in bytes. A longer one is refused before any hashing (hash: error.PasswordTooLong; verify: false), so a huge input costs the server nothing.

`spider.password.Error`

zig

pub const Error = error{PasswordTooLong} || std.mem.Allocator.Error || std.crypto.pwhash.Error

What hash fails with: error.PasswordTooLong (over max_len bytes), out of memory, or an error of the argon2 implementation.

`spider.password.hash`

zig

pub fn hash(c: *Ctx, password: []const u8) Error![]const u8

The hash of password, to store. Allocated in the request arena.

`spider.password.verify`

zig

pub fn verify(c: *Ctx, stored: []const u8, password: []const u8) bool

True when password is the one stored was made from. False for a wrong password, for a stored value that is not a hash at all, and for a password over max_len bytes.

`spider.password.hashWith`

zig

pub fn hashWith(arena: std.mem.Allocator, io: std.Io, password: []const u8) Error![]const u8

hash outside a request (a seed script, a test).

`spider.password.verifyWith`

zig

pub fn verifyWith(arena: std.mem.Allocator, io: std.Io, stored: []const u8, password: []const u8) bool

verify outside a request.

`spider.password.decoy`

zig

pub const decoy = "$argon2id$v=19$m=19456,t=2,p=1$c3BpZGVyLWRlY295LXNhbHQ$Y0rqCIYQxkoy1vQpTVV2Rk0vY0V1hYp8X8jJmJq1x0o"

A hash of nothing in particular. Verify a login against it when the account does not exist, so a missing account takes as long to refuse as a wrong password.