Repository navigation
Issue warning to folks using old sha256 hashed password #3560
Description
@jawnsy had a great idea:
I'm not sure where in the code to put it, but it would be nice to issue a warning if someone is using the plain text/cookie/sha256 methods to tell them that their authentication method is insecure, and to consider upgrading to argon2.
See: #3422 (comment)
Will look at after: #3422
Activity
finzzz commentedon Aug 10, 2021
I've tried to use argon2 but apparently it needs salt. But when I use salt, code-server cannot verify it.
jsjoeio commentedon Aug 10, 2021
Hmm...that doesn't seem right. Can you provide steps to reproduce?
finzzz commentedon Aug 10, 2021
Sorry my bad, I tried to use
instead of
But probably will help if someone encounters similar issue.
jsjoeio commentedon Aug 10, 2021
You have to use
argon2-clibecause that's what code-server uses under the hood. I don't thinkargon2will work because it uses a different hashing algorithm compared toargon2the npm package (unless it changed and it does work, but that would be new to me).Video
Here's how you can do it:
Screen.Recording.2021-08-10.at.1.55.39.PM.mov
finzzz commentedon Aug 10, 2021
I don't know what's under the hood, but it works with argon2.
jsjoeio commentedon Aug 10, 2021
Ah, interesting! Maybe I was using it wrong before but hey, glad that works then 🙌
antofthy commentedon Dec 20, 2021
I for one would love to be able to figure out (or retrieve) the session token! Either from the password, or from the code-server configuration files. So far no luck getting anything to match up to the cookie! Code-Server v3.12.0
jsjoeio commentedon Jan 3, 2022
So the user declares the password in the code-server config file. The password is then hashed and sent back in the response to the client and stored as a cookie. Here is the logic: https://github.com/coder/code-server/blob/main/src/node/routes/login.ts#L87
antofthy commentedon Jan 4, 2022
Though I declare the password in an environment variable ($PASSWORD) in a docker instance.
But after some experiments I validated the URL encoded value of the 'key' cookie, to the given password.
As such if the cookie can be preset set for that website, I should be able to auto-initialise the login for a already authenticated user.
One small step... leading to another.
Of course if the hashing method changes that all gets broken!
jsjoeio commentedon Jan 4, 2022
@antofthy well keep an eye on any argon2 issues. If it does change, we should be able to add backwards-compatibility. You'll know though from the release notes
code-asher commentedon Jul 13, 2024
Merging with #3546