User IP Hashes are now salted with 24 bits from a cryptographically secure random generation function formatted into base 64 for extra privacy/security.

src/utils/hashUtils.js

@@ -60,17 +60,40 @@ module.exports.compareLegacyPassword = function(pass, hash){
  * 
  * Provides a basic level of privacy by only logging salted hashes of IP's
  * @param {String} ip - IP to hash
- * @returns {String} Hashed/Peppered IP Adress
+ * @param {String} salt - (optional) string to salt IP with, leave empty to default to a securely generated string encoded in base64
+ * @returns {String} Hashed/Peppered/Salted IP Address
  */
-module.exports.hashIP = function(ip){
+module.exports.hashIP= function(ip, salt){
     //Create hash object
     const hashObj = crypto.createHash('sha512');
 
-    //add IP and pepper to the hash
-    hashObj.update(`${ip}${config.secrets.ipSecret}`);
+    //If we wheren't provided salt
+    if(salt == null){
+        //Generate salt with cryptographically secure rng function
+        const rawSalt = crypto.randomBytes(24);
+        //Convert generated salt to base64
+        salt = rawSalt.toString('base64');
+    }
 
-    //return the IP hash as a string
-    return hashObj.digest('hex');
+    //Generate new salted hash
+    hashObj.update(`${ip}${config.secrets.ipSecret}${salt}`);
+
+    //Convert hash data into a base64 string
+    const hash = hashObj.digest('base64');
+
+    //Return salty hash
+    return `${salt}$${hash}`;
+}
+
+module.exports.compareIPHash = function(ip, hash){
+    //Split hash by salt delimiter
+    const splitHash = hash.split("$");
+
+    //Re-generate hash from received plaintext IP and salt scraped from existing hash
+    const tempHash = module.exports.hashIP(ip, splitHash[0]);
+
+    //If the hash we calculates matches the original
+    return tempHash == hash;
 }
 
 /**