passwords-sqnfa-web
Version:
This library implements the recommendations that apply to client-side password handling from NIST and OWASP. The purpose of this library is to provide an easy pluggable client-side password preprocessor.
39 lines (38 loc) • 1.78 kB
TypeScript
import { Result } from '../result';
import { Handler } from '../types/sqnfa';
export declare class BcryptConfiguration {
/**
* A user specific salt on the format `$2a$[cost]$[22 character salt]`.
* This should come from the backend based on the user's identifier (or similar).
* OWASP recommended cost is 10. If cost is less than 10, then it should be prefixed with 0, e.g. 08.
*/
readonly salt: string;
constructor(
/**
* A user specific salt on the format `$2a$[cost]$[22 character salt]`.
* This should come from the backend based on the user's identifier (or similar).
* OWASP recommended cost is 10. If cost is less than 10, then it should be prefixed with 0, e.g. 08.
*/
salt: string);
}
export declare class BcryptHandler implements Handler {
private readonly config;
readonly name: string;
/**
* Bcrypt can be used as a means for server releif. It is a feature
* that allows the server to delegate the most expensive part of
* hashing to the client. The server, however, still need to treat
* the received value as a password and it has to undergo at least
* a preimage-resistant function. Another benefit is that the users
* original password is never sent to the server. Should the server
* leak an bcrypt hashed password, then an adversary would not be
* able to recover the actual password.
*
* Note: Bcrypt limits the password length to be 72 encoded in utf-8.
* Should the users password be longer than this, then the password
* will automatically be hashed with SHA512/432 and encoded in base64
* before being hashed by bcrypt.
*/
constructor(config: BcryptConfiguration);
handle(password: string): Promise<Result>;
}