question: API key generation fails (password length exceeds 72 bytes) : how to fix that ? about caddy-security HOT 9 CLOSED

@EntropyValley , I need to find some time to update this module.

from caddy-security.

@pav67 , that is a bug. There were recent changes to bcrypt library. Will fix and make a new release. Thank you for reporting this!

from caddy-security.

@sdsys-ch , I would try looking at it this week.

from caddy-security.

Appreciated! Great to see all the activity around caddy-security. Thanks

from caddy-security.

Any updates on this @greenpau? API Key Generation still seems to be broken in the current version. Is there a way to temporarily generate my own API key and manually add it until this is fixed?

from caddy-security.

@greenpau , I've created a dirty fix for this issue in a private repo. I'm not sure if it breaks anything or if there are security considerations I'm not aware of?

I've tested this locally and my fix allows authentication via X-Api-Key Header with ApiKeys generated via the local portal (diff for go-authcrunch - pkg:identity:database.go):

@@ -566,7 +566,7 @@ func (db *Database) AddAPIKey(r *requests.Request) error {
        if err != nil {
                return errors.ErrAddAPIKey.WithArgs(r.Key.Usage, err)
        }
-       s := GetRandomStringFromRange(72, 96)
+       s := GetRandomString(72)
        failCount := 0
        for {
                hk, err := NewPassword(s)

Since bcrypt now enforces a hard limit of 72 (non-unicode) chars, this fixes the issue.

If you don't see any issues with this, I can create a pull request. If not, let me know what I've overlooked and I might try to fix my patch?

from caddy-security.

@sdsys-ch , @pav67 , @EntropyValley , I added a fix for this. Will be available in the next release.

from caddy-security.

@sdsys-ch , thank you for the gift! Much appreciated 🎉

from caddy-security.

@pav67, @sdsys-ch , @EntropyValley , I am looking to add testimonial sections to https://authcrunch.com. Could you please write one and send it to me at [email protected]?

from caddy-security.