storefront-api icon indicating copy to clipboard operation
storefront-api copied to clipboard

Add initialization-vector to `encryptToken` and `decryptToken` methods

Open cewald opened this issue 5 years ago • 0 comments

Related issues

There is an error when a submitted token is de-/encrypted in user endpoint: Missing IV for cipher aes-256-ctr.

This is caused by the changes on decryptToken & encryptToken of packages/lib/util.ts where the deprecated method createDecipher() method was replaced with createDecipheriv(). Currently there is a null value as default value submitted but as I found out the aes-256-ctr algorithm needs an initialization-vector to work.

I added a config option cipherIVByBuildTime to either add a custom cipher based on build-time or just use a default 16 character string or randomBytes.

I also added a small script build:time to create a buildtime.json on build where the buildtime is stored for multi-node support.

Contribution and currently important rules acceptance

cewald avatar Jan 05 '21 08:01 cewald