From 87af1eb17081946b92ad5b1104bbd7223284e764 Mon Sep 17 00:00:00 2001 From: Roman Strobl Date: Wed, 23 Oct 2024 14:37:56 +0800 Subject: [PATCH] Fix #1720: Update documentation for bcrypt --- docs/Basic-Definitions.md | 2 +- docs/Next-Step-Server-REST-API-Reference.md | 2 ++ 2 files changed, 3 insertions(+), 1 deletion(-) diff --git a/docs/Basic-Definitions.md b/docs/Basic-Definitions.md index c876e9d88..f867748cb 100644 --- a/docs/Basic-Definitions.md +++ b/docs/Basic-Definitions.md @@ -221,7 +221,7 @@ When the user identity is managed by the Next Step application, Next Step provid ### Next Step -- credential hashing -Next Step application hashes the user credentials using the Argon2 hashing algorithm. The credential verification is performed by comparing the hash of the credential with the stored hash. The hashing algorithm parameters can be changed and in this case the credential hash is recreated with new parameters during the next user authentication and stored in the database. +Next Step application hashes the user credentials using the Argon2 or Bcrypt hashing algorithms. The credential verification is performed by comparing the hash of the credential with the stored hash. For Argon2, the hashing algorithm parameters can be changed to provide strong hashing. In this case the credential hash is recreated with new parameters during the next user authentication and stored in the database. We recommend to use Argon2 instead of Bcrypt, which was added mainly for compatibility reasons and does not support hashing strength configuration. ### Next Step -- database record encryption diff --git a/docs/Next-Step-Server-REST-API-Reference.md b/docs/Next-Step-Server-REST-API-Reference.md index 006457ace..e71b63963 100644 --- a/docs/Next-Step-Server-REST-API-Reference.md +++ b/docs/Next-Step-Server-REST-API-Reference.md @@ -5701,6 +5701,8 @@ The list of expected status codes: } ``` +Possible algorithm names: `ARGON_2D`, `ARGON_2I`, `ARGON_2ID`, `BCRYPT`. For `BCRYPT` empty parameters should be used as this algorithm does not support hashing algorithm parameterization. + #### Response 200 - Headers: