A Fresh Salt

Part of the Auth and Security section of Coddy's Node.js journey. Lesson 3 of 24.

People can choose the same password. A salt is random data included when deriving the stored password key. A fresh salt makes equal passwords produce different stored keys. The salt is saved beside the key; it does not need to be secret.

const salt = randomBytes(8).toString('hex');
// 8 random bytes written as 16 hex characters

Generate the salt inside the function called for each new password. A value created once when the server starts would be reused. You have derived a key using a fixed practice salt. Password storage now needs a fresh one each time. Here, practise only generating the salt and seeing its 32-character text length.

randomBytes uses a cryptographic random generator. Math.random() is not intended for security-sensitive values. Use the imported cryptographic function for the salt.

Challenge

Easy

This is a small practice project. Its setup is provided; edit only exercise.js.

Return a fresh 16-byte random salt as hex in salt. Run and GET /result twice: each response contains a different 32-character hex string. Do not use a fixed salt.

Try it yourself

import { randomBytes } from 'node:crypto';
export function exercise() {
    return { salt: '00000000000000000000000000000000' };
}

All lessons in Auth and Security

Practice on your own: Express playground