Updating argon2 password guidance.#848

oeribo

Hey there! So you want to contribute to a Firebase SDK?
Before you file this pull request, please read these guidelines:

Discussion

Read the contribution guidelines (CONTRIBUTING.md).
If this has been discussed in an issue, make sure to link to the issue here.
If not, go file an issue about this before creating a pull request to discuss.

Testing

Make sure all existing tests in the repository pass after your change.
If you fixed a bug or added a feature, add a new test to cover your code.

API Changes

At this time we cannot accept changes that affect the public API. If you'd like to help
us make Firebase APIs better, please propose your change in an issue so that we
can discuss it together.

@oeribo

Hi @oeribo,

Thank you very much for contributing.

Could you provide a little more context on the new guidance that you are suggesting for Argon2 here? It looks like to me that you're trying to match other snippets that use the Base64 decoding libraries in the other examples from https://firebase.google.com/docs/auth/admin/import-users#java_2 (which is perfectly fine! I wanted to make sure that I got this right).

Since this is just a snippet, could you please revert this string back to the the descriptive version ("password-hash" or "salt"), since it makes it clearer to the developer where this input comes from, and matches other examples.

Updating argon2 password guidance.

88118d9

lahirumaramba requested a review from ssbushi October 4, 2023 16:56

lahirumaramba assigned ssbushi Oct 4, 2023

ssbushi reviewed Oct 10, 2023

View reviewed changes

-                        .setPasswordSalt("salt".getBytes())
+                        .setEmailVerified(true)
+                        .setPasswordSalt(Base64.getDecoder().decode("VERvRWRsRklaVERQckJzUg")) // Provide the password salt only
+                        .setPasswordHash(Base64.getDecoder().decode("dYpfJgmRyTZefxRiToYFpO+4PyaHPsHIKz5VI/FE06w")) // Provide the password key only

-                        .setPasswordHash("password-hash".getBytes())
-                        .setPasswordSalt("salt".getBytes())
+                        .setEmailVerified(true)
+                        .setPasswordSalt(Base64.getDecoder().decode("VERvRWRsRklaVERQckJzUg")) // Provide the password salt only

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Updating argon2 password guidance.#848