Argon2 Failing Again

Wappler General Bugs
1

Wappler Version : 4.4.5
Operating System : W10
Server Model: NodeJS
Database Type: MySQL

Continuing the discussion from our earlier post: Argon2 Secure Login - 401 Error
Getting same error as before. Argon hash stored in the DB seems correct. But when entering the actual password, it fails with 401.

As suggested in previous post, I have re-created the lib folder. I have also installed/updated/cleaned packages. But no luck.

This time, entering the hash from DB in password field does not work either… so something else is breaking this time.
Please help.

2

Maybe post some screenshots showing how are the security/login steps setup in server connect.

3

Similar to as shown in the docs. Only difference is my server action for Signup has a couple more steps - irrelevant to Argon. Security restrict and login same as in doc.

I checked the logs as well, and there is no error being shown.

4

Security Restrict

image
image1717×722 45.8 KB

Signup

image
image960×406 16.8 KB

Login

image
image936×313 13.3 KB

5

Found the bug, by comparing database.js file from another project where Argon2 is working.
Line 23:

if (passwordVerify && password.startsWith('$')) {

Should instead be:

if (passwordVerify && result[this.users.password].startsWith('$')) {

I have tried deleting and letting Wappler recreate the database.js file, but it still created the incorrect file. Changing this to Bug.

1 Like
8

Sid, this has been fixed in an Update in December 2021 and should be just fine in the latest versions.

9

There still seems to be an issue with how Wappler updates its lib files.

10

There are no issues with that, i just tested with the latest version and the code in the database.js is just as expected:

if (passwordVerify && result[this.users.password].startsWith('$')) {

Please update to the latest version.

12

You are missing the point. The point here is that Wappler is failing to update the file when upgrading project from an older version of Wappler to newer.
I don’t see any changes with regards to the way Wappler updates its files in 4.5.0 & 4.5.1, given that I am on 4.4.5. So updating to latest version will not do anything.

Also, this change was actually done in 4.4.5 as you have pointed in my previous post: Argon2 Secure Login - 401 Error.
So Wappler should have updated the file when lib was deleted and re-created automatically since I am on 4.4.5.

If you chose to ignore it, nothing I can do about it. I have reported the issue that I have been able to reproduce reliably.

13

Thank you so much for posting this solution @sid :slight_smile: !

This fixed my issue from this thread Node Argon2 login unauthorized?

I confirm it’s a bug: I am on the latest wappler version (4.5.3).

1 Like
14

I can confirm I am experiencing this bug with a project I’m currently working on.
I have just updated to Wappler V4.6.1 for reference.

Thanks a million for the fix @sid!

1 Like