feat: add support for migration of firebase scrypt passwords #1768

J0 · 2024-09-06T07:38:33Z

What kind of change does this PR introduce?

Fix #1750. Firebase uses a modified version of scrypt We add support for Firebase Scrypt hashes so that developers can move over from Firebase (or similar) without the obligation to force a password reset for all users.

As there is no pre-defined convention for Firebase scrypt hashes, we establish the following:

$fbscrypt$v=1,n=<N>,r=<r>,p=<p>,ss=<salt_separator>,sk=<signer_key>$<salt>$<hash>

$fbscrypt: Firebase scrypt Identifier
$v: version identifier. Intended to allow for flexibility in parameters used.
$n: N is the CPU/memory cost parameter.
$r: block size
$p: parallelization
$ss: salt seperator, optional, only if using firebase,  base64-encoded string used to separate the salt from other parameters.
$sk: signer key, a base64-encoded string used as an additional input to the hash function.
$<salt>: base64 encoded salt
$<hash>: base64 encoded output

Developers can extract their hash parameters from the firebase console

For testing and debugging, clone this utility and follow the instructions in BUILDING.

On MacOS please add the following flags when attempting to build so as to guard against error: AES_FUNCTION missing

export CFLAGS="-I$(brew --prefix openssl)/include"
export LDFLAGS="-L$(brew --prefix openssl)/lib -L/usr/local/opt/openssl/lib"

More details about export from CLI

You'll can then to use the admin method to update the PasswordHash

internal/crypto/password.go

hf · 2024-09-24T07:25:52Z

Would prefer if the name for the Firebase scrypt be fbscrypt instead of scrypt.

coveralls · 2024-09-25T10:46:57Z

Pull Request Test Coverage Report for Build 11048130786

Details

91 of 121 (75.21%) changed or added relevant lines in 2 files are covered.
No unchanged relevant lines lost coverage.
Overall coverage increased (+0.1%) to 57.916%

Changes Missing Coverage	Covered Lines	Changed/Added Lines	%
internal/crypto/password.go	85	115	73.91%

Totals
Change from base Build 11017821166:	0.1%
Covered Lines:	9332
Relevant Lines:	16113

💛 - Coveralls

internal/crypto/password.go

hf

Looks good! Thanks!

🤖 I have created a release *beep* *boop* --- ## [2.162.0](v2.161.0...v2.162.0) (2024-09-27) ### Features * add support for migration of firebase scrypt passwords ([#1768](#1768)) ([ba00f75](ba00f75)) ### Bug Fixes * apply authorized email restriction to non-admin routes ([#1778](#1778)) ([1af203f](1af203f)) * magiclink failing due to passwordStrength check ([#1769](#1769)) ([7a5411f](7a5411f)) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please). Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

## What kind of change does this PR introduce? As per title - relevant PR: supabase/auth#1768

## What kind of change does this PR introduce? Fix #1750. Firebase uses a [modified version of scrypt](https://github.com/firebase/scrypt) We add support for Firebase Scrypt hashes so that developers can move over from Firebase (or similar) without the obligation to force a password reset for all users. As there is no pre-defined convention for Firebase scrypt hashes, we establish the following: ``` $fbscrypt$v=1,n=<N>,r=<r>,p=<p>[,ss=<salt_separator>][,sk=<signer_key>]$<salt>$<hash> ``` ``` $fbscrypt: Firebase scrypt Identifier $v: version identifier. Intended to allow for flexibility in parameters used. $n: N is the CPU/memory cost parameter. $r: block size $p: parallelization $ss: salt seperator, optional, only if using firebase, base64-encoded string used to separate the salt from other parameters. $sk: signer key, a base64-encoded string used as an additional input to the hash function. $<salt>: base64 encoded salt $<hash>: base64 encoded output ```` Developers can extract their [hash parameters from the firebase console](https://firebaseopensource.com/projects/firebase/scrypt/) For testing and debugging, clone this [utility](https://github.com/firebase/scrypt/#finding-the-password-hash-parameters) and follow the instructions in `BUILDING`. On MacOS please add the following flags when attempting to build so as to guard against error: `AES_FUNCTION` missing ``` export CFLAGS="-I$(brew --prefix openssl)/include" export LDFLAGS="-L$(brew --prefix openssl)/lib -L/usr/local/opt/openssl/lib" ``` [More details about export from CLI](https://firebase.google.com/docs/cli/auth)

🤖 I have created a release *beep* *boop* --- ## [2.162.0](v2.161.0...v2.162.0) (2024-09-27) ### Features * add support for migration of firebase scrypt passwords ([#1768](#1768)) ([ba00f75](ba00f75)) ### Bug Fixes * apply authorized email restriction to non-admin routes ([#1778](#1778)) ([1af203f](1af203f)) * magiclink failing due to passwordStrength check ([#1769](#1769)) ([7a5411f](7a5411f)) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please). Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

…e#1768) ## What kind of change does this PR introduce? Fix supabase#1750. Firebase uses a [modified version of scrypt](https://github.com/firebase/scrypt) We add support for Firebase Scrypt hashes so that developers can move over from Firebase (or similar) without the obligation to force a password reset for all users. As there is no pre-defined convention for Firebase scrypt hashes, we establish the following: ``` $fbscrypt$v=1,n=<N>,r=<r>,p=<p>[,ss=<salt_separator>][,sk=<signer_key>]$<salt>$<hash> ``` ``` $fbscrypt: Firebase scrypt Identifier $v: version identifier. Intended to allow for flexibility in parameters used. $n: N is the CPU/memory cost parameter. $r: block size $p: parallelization $ss: salt seperator, optional, only if using firebase, base64-encoded string used to separate the salt from other parameters. $sk: signer key, a base64-encoded string used as an additional input to the hash function. $<salt>: base64 encoded salt $<hash>: base64 encoded output ```` Developers can extract their [hash parameters from the firebase console](https://firebaseopensource.com/projects/firebase/scrypt/) For testing and debugging, clone this [utility](https://github.com/firebase/scrypt/#finding-the-password-hash-parameters) and follow the instructions in `BUILDING`. On MacOS please add the following flags when attempting to build so as to guard against error: `AES_FUNCTION` missing ``` export CFLAGS="-I$(brew --prefix openssl)/include" export LDFLAGS="-L$(brew --prefix openssl)/lib -L/usr/local/opt/openssl/lib" ``` [More details about export from CLI](https://firebase.google.com/docs/cli/auth)

🤖 I have created a release *beep* *boop* --- ## [2.162.0](supabase/auth@v2.161.0...v2.162.0) (2024-09-27) ### Features * add support for migration of firebase scrypt passwords ([supabase#1768](supabase#1768)) ([ba00f75](supabase@ba00f75)) ### Bug Fixes * apply authorized email restriction to non-admin routes ([supabase#1778](supabase#1778)) ([1af203f](supabase@1af203f)) * magiclink failing due to passwordStrength check ([supabase#1769](supabase#1769)) ([7a5411f](supabase@7a5411f)) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please). Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

## What kind of change does this PR introduce? Fix #1750. Firebase uses a [modified version of scrypt](https://github.com/firebase/scrypt) We add support for Firebase Scrypt hashes so that developers can move over from Firebase (or similar) without the obligation to force a password reset for all users. As there is no pre-defined convention for Firebase scrypt hashes, we establish the following: ``` $fbscrypt$v=1,n=<N>,r=<r>,p=<p>[,ss=<salt_separator>][,sk=<signer_key>]$<salt>$<hash> ``` ``` $fbscrypt: Firebase scrypt Identifier $v: version identifier. Intended to allow for flexibility in parameters used. $n: N is the CPU/memory cost parameter. $r: block size $p: parallelization $ss: salt seperator, optional, only if using firebase, base64-encoded string used to separate the salt from other parameters. $sk: signer key, a base64-encoded string used as an additional input to the hash function. $<salt>: base64 encoded salt $<hash>: base64 encoded output ```` Developers can extract their [hash parameters from the firebase console](https://firebaseopensource.com/projects/firebase/scrypt/) For testing and debugging, clone this [utility](https://github.com/firebase/scrypt/#finding-the-password-hash-parameters) and follow the instructions in `BUILDING`. On MacOS please add the following flags when attempting to build so as to guard against error: `AES_FUNCTION` missing ``` export CFLAGS="-I$(brew --prefix openssl)/include" export LDFLAGS="-L$(brew --prefix openssl)/lib -L/usr/local/opt/openssl/lib" ``` [More details about export from CLI](https://firebase.google.com/docs/cli/auth)

🤖 I have created a release *beep* *boop* --- ## [2.162.0](v2.161.0...v2.162.0) (2024-09-27) ### Features * add support for migration of firebase scrypt passwords ([#1768](#1768)) ([ba00f75](ba00f75)) ### Bug Fixes * apply authorized email restriction to non-admin routes ([#1778](#1778)) ([1af203f](1af203f)) * magiclink failing due to passwordStrength check ([#1769](#1769)) ([7a5411f](7a5411f)) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please). Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

## What kind of change does this PR introduce? As per title - relevant PR: supabase/auth#1768

J0 commented Sep 16, 2024

View reviewed changes

internal/crypto/password.go Outdated Show resolved Hide resolved

J0 force-pushed the j0/add_scrypt_password_hash branch 2 times, most recently from ba549df to 5d88639 Compare September 25, 2024 06:47

J0 commented Sep 25, 2024

View reviewed changes

internal/crypto/password.go Outdated Show resolved Hide resolved

J0 marked this pull request as ready for review September 25, 2024 12:08

J0 requested a review from a team as a code owner September 25, 2024 12:08

J0 force-pushed the j0/add_scrypt_password_hash branch from df090f3 to d524770 Compare September 25, 2024 12:10

J0 commented Sep 25, 2024

View reviewed changes

internal/crypto/password.go Outdated Show resolved Hide resolved

J0 commented Sep 25, 2024

View reviewed changes

internal/crypto/password.go Show resolved Hide resolved

J0 changed the title ~~fix: add support for migration of scrypt passwords~~ feat: add support for migration of firebase scrypt passwords Sep 25, 2024

hf reviewed Sep 25, 2024

View reviewed changes

internal/crypto/password.go Show resolved Hide resolved

hf approved these changes Sep 25, 2024

View reviewed changes

feat: add firebase scrypt

e3768ab

J0 force-pushed the j0/add_scrypt_password_hash branch from d524770 to e3768ab Compare September 26, 2024 08:05

J0 merged commit ba00f75 into master Sep 26, 2024

J0 deleted the j0/add_scrypt_password_hash branch September 26, 2024 08:13

github-actions bot mentioned this pull request Sep 26, 2024

chore(master): release 2.162.0 #1777

Merged

J0 mentioned this pull request Dec 24, 2024

fix: update docs to add scrypt supabase/auth-js#1012

Merged

hf pushed a commit to supabase/auth-js that referenced this pull request Dec 26, 2024

fix: update docs to add scrypt (#1012)

1225239

## What kind of change does this PR introduce? As per title - relevant PR: supabase/auth#1768

mandarini pushed a commit to supabase/supabase-js that referenced this pull request Oct 2, 2025

fix: update docs to add scrypt (#1012)

0dc969a

## What kind of change does this PR introduce? As per title - relevant PR: supabase/auth#1768

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

feat: add support for migration of firebase scrypt passwords #1768

feat: add support for migration of firebase scrypt passwords #1768

Uh oh!

J0 commented Sep 6, 2024 •

edited

Loading

Uh oh!

Uh oh!

hf commented Sep 24, 2024

Uh oh!

coveralls commented Sep 25, 2024 •

edited

Loading

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

hf left a comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

feat: add support for migration of firebase scrypt passwords #1768

feat: add support for migration of firebase scrypt passwords #1768

Uh oh!

Conversation

J0 commented Sep 6, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What kind of change does this PR introduce?

Uh oh!

Uh oh!

hf commented Sep 24, 2024

Uh oh!

coveralls commented Sep 25, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Pull Request Test Coverage Report for Build 11048130786

Details

💛 - Coveralls

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

hf left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

J0 commented Sep 6, 2024 •

edited

Loading

coveralls commented Sep 25, 2024 •

edited

Loading