MythEclipse/imphnen-backend-service
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: Refactor password hashing and JWT encoding to use static keys for improved performance and security

Browse Source
This commit is contained in:
MythEclipse
2025-08-16 13:43:18 +07:00
parent b70126734e
commit 00fd7e1907
2 changed files with 17 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files
imphnen-libs/src/argon/mod.rs
+5 -9
View File
@@ -8,15 +8,11 @@ use argon2::{
pub fn hash_password(password: &str) -> Result<String, Error> { pub fn hash_password(password: &str) -> Result<String, Error> {
let salt = SaltString::generate(&mut OsRng); let salt = SaltString::generate(&mut OsRng);
let argon2 = if std::env::var("RUST_ENV").unwrap_or_default() == "test" || std::env::var("RUST_ENV").unwrap_or_default() == "development" { let argon2 = Argon2::new(
Argon2::new( argon2::Algorithm::Argon2id,
argon2::Algorithm::Argon2id, argon2::Version::V0x13,
argon2::Version::V0x13, argon2::Params::new(1024, 1, 1, None).unwrap() // 1MB, 1 iteration, 1 thread (faster, less secure)
argon2::Params::new(8 * 1024, 2, 1, None).unwrap() // 8MB, 2 iterations, 1 thread );
)
} else {
Argon2::default()
};
let password_hash = argon2 let password_hash = argon2
.hash_password(password.as_bytes(), &salt)? .hash_password(password.as_bytes(), &salt)?
.to_string(); .to_string();
imphnen-libs/src/jsonwebtoken/mod.rs
+12 -8
View File
@@ -15,18 +15,20 @@ pub struct Claims {
pub permissions: Vec<String>, pub permissions: Vec<String>,
} }
static ACCESS_HEADER: once_cell::sync::Lazy<Header> = once_cell::sync::Lazy::new(Header::default);
static ACCESS_KEY: once_cell::sync::Lazy<EncodingKey> = once_cell::sync::Lazy::new(|| {
EncodingKey::from_secret(ENV.access_token_secret.as_ref())
});
pub fn encode_access_token(sub: String, user_id: String, permissions: Vec<String>) -> Result<String, StatusCode> { pub fn encode_access_token(sub: String, user_id: String, permissions: Vec<String>) -> Result<String, StatusCode> {
let env = &ENV;
let secret: String = env.access_token_secret.clone();
let now = Utc::now(); let now = Utc::now();
let expire: TimeDelta = Duration::minutes(15); let expire: TimeDelta = Duration::minutes(15);
let exp: usize = (now + expire).timestamp() as usize; let exp: usize = (now + expire).timestamp() as usize;
let iat: usize = now.timestamp() as usize; let iat: usize = now.timestamp() as usize;
let claim = Claims { iat, exp, sub, user_id, permissions }; let claim = Claims { iat, exp, sub, user_id, permissions };
encode( encode(
&Header::default(), &ACCESS_HEADER,
&claim, &claim,
&EncodingKey::from_secret(secret.as_ref()), &ACCESS_KEY,
) )
.map_err(|_| StatusCode::INTERNAL_SERVER_ERROR) .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)
} }
@@ -61,18 +63,20 @@ pub fn decode_access_token(
result result
} }
static REFRESH_HEADER: once_cell::sync::Lazy<Header> = once_cell::sync::Lazy::new(Header::default);
static REFRESH_KEY: once_cell::sync::Lazy<EncodingKey> = once_cell::sync::Lazy::new(|| {
EncodingKey::from_secret(ENV.refresh_token_secret.as_ref())
});
pub fn encode_refresh_token(sub: String, user_id: String, permissions: Vec<String>) -> Result<String, StatusCode> { pub fn encode_refresh_token(sub: String, user_id: String, permissions: Vec<String>) -> Result<String, StatusCode> {
let env = &ENV;
let secret: String = env.refresh_token_secret.clone();
let now = Utc::now(); let now = Utc::now();
let expire: TimeDelta = Duration::days(1); let expire: TimeDelta = Duration::days(1);
let exp: usize = (now + expire).timestamp() as usize; let exp: usize = (now + expire).timestamp() as usize;
let iat: usize = now.timestamp() as usize; let iat: usize = now.timestamp() as usize;
let claim = Claims { iat, exp, sub, user_id, permissions }; let claim = Claims { iat, exp, sub, user_id, permissions };
encode( encode(
&Header::default(), &REFRESH_HEADER,
&claim, &claim,
&EncodingKey::from_secret(secret.as_ref()), &REFRESH_KEY,
) )
.map_err(|_| StatusCode::INTERNAL_SERVER_ERROR) .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)
} }