Node Argon2 login unauthorized?

[karh]

I’m moving from a SHA hash to Argon2 for our password encryption.

But I can’t seem to get the login to work.

I’ve followed the doc and made sure that ‘Use Password Hash Verify’ is checked (I also made a new one in case anything bugs out with changing the old one)

I’m sure the password is hashed with argon, can see it starts with $argon in the db.

I also made a new ‘login’ server action, and made sure that the password is not being formatted by anything. It’s just having the raw POST inputs:

Yet I get an unauthorized error when logging in:

I can still login with the old SHA hashed passwords, so I am guessing that the ‘Use Password Hash Verify’ is not working?

Is it a bug? Anything else I can try?

[sid]

Check this:

Argon2 Failing Again

Found the bug, by comparing database.js file from another project where Argon2 is working. Line 23: if (passwordVerify && password.startsWith('$')) { Should instead be: if (passwordVerify && result[this.users.password].startsWith('$')) { I have tried deleting and letting Wappler recreate the database.js file, but it still created the incorrect file. Changing this to Bug.

[Teodor]

@karh

can still login with the old SHA hashed passwords

What do you mean? You enter your SHA hash and you are logged in?
That won't be possible if the passwords in the database start with $argon - are you sure you are using the correct database table and security provider?

Also how did you 'convert' the old SHA hashes to argon?

[karh]

Thank you thank you! That fixed it.

@Teodor what I meant is that I have tried to login with a SHA hash encrypted password.
For example:
Username: myusername
Password: mypassword
In the db: 9f338c1199c9e17824c8585162cdd000cefd80e3849f9f312bd65c3601fa96569c9c17c2d4a3e98b7b466a73de2270ba994daca9aa1a1d03b84e48c462e577a6

Then I also tried to login with a new information that I encrypted with argon, like:
Username: myusername
Password: newpassword
In the db: $argon2id$v=19...

Either way, I don’t think we need to debug this further as the issue is fixed by applying Sid’s fix: Argon2 Failing Again

So for some reason my database.js was not the right version, I added some info in that thread.

[Teodor]

So have you clicked yes, when the update components prompt appeared on project open? I just tested this and cannot really recreate this issue.

[sid]

I have a project where the Bootstrap file generated has incorrect sequencing of media queries.
Its just one project. All other projects with/without custom theme manager changes, work perfectly fine.

Its just one of those things I guess, which doesn’t have a clear reason why its happenning. It has definitely something to do with the way Wappler updates files or saves project information, but just unable to reproduce.

[karh]

I’ve been updating every component since that feature was introduced
No idea what other info I can give

Basically I’ve just been updating wappler and all the components if prompted, always and usually within 24h of a wappler update being released.

The only possible explanation I can think of that I could mess up on my end is that sometimes these updates happen while I’m working on a branch.

Perhaps this particular file was updated while working on another branch, and is still on there.

I’ll try see if I can find a change log of this particular file in git…

EDIT: I found a commit in december where I updated wappler to 4.4.5 and there the database.js file did get updated well it seems?

However now it gets weird:

Apart from that commit, the only other commit that changed this file is the one I just did where I manually changed the code:
Here you see the change history of that file

Here is the latest commit:

Then what has changed that database.js file?