npm - arcanajs - Versions diffs - 6.0.4 → 6.0.5 - Mend

arcanajs 6.0.4 → 6.0.5

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (6) hide show

package/dist/development/arcanajs.auth.js +5 -2
package/dist/development/arcanajs.auth.js.map +1 -1
package/dist/lib/auth/utils/PasswordHasher.d.ts +2 -0
package/dist/production/arcanajs.auth.min.js +1 -1
package/dist/production/arcanajs.auth.min.js.map +1 -1
package/package.json +1 -1

package/dist/development/arcanajs.auth.js CHANGED Viewed

@@ -3138,14 +3138,17 @@ class PasswordHasher {
   /**
    * Apply pepper to password (server-side secret)
+   * Concatenates pepper with password so Argon2 receives the full password data.
+   * This preserves password entropy while adding the server-side secret.
    */
   static applyPepper(password) {
     var _this$config14;
     if (!((_this$config14 = this.config) !== null && _this$config14 !== void 0 && _this$config14.pepper)) {
       return password;
     }
-    // Use HMAC to combine password with pepper
-    return crypto__WEBPACK_IMPORTED_MODULE_1___default().createHmac("sha256", this.config.pepper).update(password).digest("hex");
+    // Concatenate pepper with password - Argon2 will handle the secure hashing
+    // Using pepper as prefix prevents length-extension attacks
+    return this.config.pepper + password;
   }
   /**