Skip to content

Switch to Argon2 password hashing - #7879

Open
jantekb wants to merge 5 commits into
masterfrom
feature/argon3
Open

jantekb wants to merge 5 commits into
masterfrom
feature/argon3

Conversation

@jantekb

@jantekb jantekb commented Jun 10, 2026

Copy link
Copy Markdown
Contributor

mekya
mekya previously requested changes Jun 22, 2026

@mekya mekya left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hi @jantekb
There are two things.

  1. Please make the tests pass.
  2. Make sure it passes the following scenario. I highly encourage you to write integration test code because this simple change may cause too much headache to us if it works for the below scenario.
    • Let a user having username/password signup/login to the webpanel
    • Upgrade the server with this improvement
    • Check that user with same username/password login to the webpanel

PS: There are some version upgrade scenarios are running on enterprise side, so you may write this test code easily.

@jantekb

jantekb commented Jun 23, 2026

Copy link
Copy Markdown
Contributor Author

@mekya an integration test for that would run every time in the next many years, making it necessary to install a pre-argon2 version, run the upgrade and then test it. I think it would be more economical to test the upgradePasswordIfNeeded method in the commonrestservice - which I realize I failed to do properly. Is that ok with you if I do that?

@jantekb

jantekb commented Jun 29, 2026

Copy link
Copy Markdown
Contributor Author

proactively I have covered the upgrade path (positive and negative) in f9a337f

@mekya

mekya commented Jul 10, 2026

Copy link
Copy Markdown
Contributor

@mekya an integration test for that would run every time in the next many years, making it necessary to install a pre-argon2 version, run the upgrade and then test it. I think it would be more economical to test the upgradePasswordIfNeeded method in the commonrestservice - which I realize I failed to do properly. Is that ok with you if I do that?

Hi @jantekb

I want you to make sure that you are covering the scenario below. The simple and fast way is preferred.

Let a user having username/password signup/login to the webpanel
Upgrade the server with this improvement
Check that user with same username/password login to the webpanel

If you are saying that it already covers, that's ok.

@jantekb
jantekb force-pushed the feature/argon3 branch 3 times, most recently from c8c9af8 to 38f7587 Compare July 14, 2026 12:53
Comment thread src/main/java/io/antmedia/console/security/PasswordService.java Fixed
Comment thread src/main/java/io/antmedia/console/rest/CommonRestService.java Fixed
@sonarqubecloud

Copy link
Copy Markdown

Quality Gate Failed Quality Gate failed

Failed conditions
D Security Rating on New Code (required ≥ A)

See analysis details on SonarQube Cloud

Catch issues before they fail your Quality Gate with our IDE extension SonarQube for IDE

Comment thread src/main/java/io/antmedia/console/security/PasswordService.java Fixed
Comment thread src/main/java/io/antmedia/console/rest/CommonRestService.java Fixed
Comment thread src/main/java/io/antmedia/console/security/PasswordService.java Fixed
Comment thread src/main/java/io/antmedia/console/rest/CommonRestService.java Fixed
@sonarqubecloud

sonarqubecloud Bot commented Oct 6, 2026

Copy link
Copy Markdown

@jantekb
jantekb dismissed mekya’s stale review October 7, 2026 14:22

discussed offline

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants