google-labs-jules[bot] 8ab1a3d5ea Fix scrypt hash generation in plaintext fallback ...

- Adjusted `generateScryptHash` parameter in plaintext fallback logic in `lib/auth.ts` to use `storedPassword` instead of the intermediate hashed value. This prevents users from getting locked out when they adopt the recommended hash.
- Enhanced plaintext fallback verification to hash `password` and `storedPassword` via keyed HMAC before executing `crypto.timingSafeEqual` to avoid potential timing attacks more securely.

Co-authored-by: ralksta <16941050+ralksta@users.noreply.github.com>

2026-05-05 10:34:52 +00:00

5.2 KiB

Raw Blame History

View Raw