storefront-api
storefront-api copied to clipboard
Add initialization-vector to `encryptToken` and `decryptToken` methods
Related issues
There is an error when a submitted token is de-/encrypted in user endpoint: Missing IV for cipher aes-256-ctr.
This is caused by the changes on decryptToken & encryptToken of packages/lib/util.ts where the deprecated method createDecipher() method was replaced with createDecipheriv(). Currently there is a null value as default value submitted but as I found out the aes-256-ctr algorithm needs an initialization-vector to work.
I added a config option cipherIVByBuildTime to either add a custom cipher based on build-time or just use a default 16 character string or randomBytes.
I also added a small script build:time to create a buildtime.json on build where the buildtime is stored for multi-node support.
Contribution and currently important rules acceptance
- [x] I read and followed contribution rules