3 ms·
The only place where "node" is necessary is for password hashing, and as there’s no cryptographically secure way to hash passwords on CF Workers or other edge r
by bekacru 2y ago
The only place where "node" is necessary is for password hashing, and as there’s no cryptographically secure way to hash passwords on CF Workers or other edge runtimes it's not really an option. At this stage of the project, supporting Deno isn't a priority but for those not using email and password auth, CF Workers and other edge/serverless runtimes should work just fine
- trescenzi 2y agoIs there a reason the web crypto api doesn’t work? CF workers support it: https://developers.cloudflare.com/workers/runtime-apis/web-crypto/ https://developers.cloudflare.com/workers/runtime-apis/web-c... Most browsers support it: https://developer.mozilla.org/en-US/docs/Web/API/Crypto https://developer.mozilla.org/en-US/docs/Web/API/Crypto
- maxbond 2y ago(I am not a cryptographer.) None of the hashes available in webcrypto's digest() are suitable for storing passwords (eg it doesn't support argon2, scrypt, bcrypt, or PBKDF2). They are all SHA family hashes. https://developer.mozilla.org/en-US/docs/Web/API/SubtleCrypto/digest https://developer.mozilla.org/en-US/docs/Web/API/SubtleCrypt... You can use PBKDF2 through the deriveKey() function. So you could use that to store passwords. However, this is the least preferred of the acceptable algorithms, and is only recommended for use in scenarios where you must follow a standard that mandates the use of PBKDF2.
- pmdfgy 2y agoYou can rename the project to "The most comprehensive authentication library for node" then.