rainbownapkin/canopy
1
0
Fork 0
Code Issues 2 Pull requests Actions Packages Projects Releases Wiki Activity

Improved Email Change and Password Reset token security by increasing token size.

Browse source
This commit is contained in:
rainbow napkin 2025-10-18 08:36:05 -04:00
parent 06f552a9ec
commit 7f6abdf8e2
3 changed files with 4 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
src/schemas/user/emailChangeSchema.js
View file

@ -52,7 +52,7 @@ const emailChangeSchema = new mongoose.Schema({
type: mongoose.SchemaTypes.String, type: mongoose.SchemaTypes.String,
required: true, required: true,
//Use a cryptographically secure algorythm to create a random hex string from 16 bytes as our change/cancel token //Use a cryptographically secure algorythm to create a random hex string from 16 bytes as our change/cancel token
default: ()=>{return crypto.randomBytes(16).toString('hex')} default: ()=>{return crypto.randomBytes(32).toString('hex')}
}, },
ipHash: { ipHash: {
type: mongoose.SchemaTypes.String, type: mongoose.SchemaTypes.String,

2
src/schemas/user/passwordResetSchema.js
View file

@ -48,7 +48,7 @@ const passwordResetSchema = new mongoose.Schema({
type: mongoose.SchemaTypes.String, type: mongoose.SchemaTypes.String,
required: true, required: true,
//Use a cryptographically secure algorythm to create a random hex string from 16 bytes as our reset token //Use a cryptographically secure algorythm to create a random hex string from 16 bytes as our reset token
default: ()=>{return crypto.randomBytes(16).toString('hex')} default: ()=>{return crypto.randomBytes(32).toString('hex')}
}, },
ipHash: { ipHash: {
type: mongoose.SchemaTypes.String, type: mongoose.SchemaTypes.String,

4
src/validators/accountValidator.js
View file

@ -185,8 +185,8 @@ module.exports.securityToken = function(field = 'token'){
isHexadecimal: true, isHexadecimal: true,
isLength: { isLength: {
options: { options: {
min: 32, min: 64,
max: 32 max: 64
} }
}, },
errorMessage: "Invalid security token." errorMessage: "Invalid security token."