Skip to content

[CRE-1848] Don't output hashed passwords. #21601

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
pavel-raykov merged 2 commits into from
Mar 19, 2026
Merged

[CRE-1848] Don't output hashed passwords. #21601

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
0c5b1ce
minor.
pavel-raykov Mar 19, 2026
8c740c9
minor.
pavel-raykov Mar 19, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion core/sessions/ldapauth/ldap.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -629,7 +629,7 @@ func (l *ldapAuthenticator) localLoginFallback(ctx context.Context, sr sessions.
return user, errors.New("invalid email")
}

if !utils.CheckPasswordHash(sr.Password, user.HashedPassword) {
if !utils.CheckPasswordHash(sr.Password, string(user.HashedPassword)) {
l.auditLogger.Audit(audit.AuthLoginFailedPassword, map[string]any{"email": sr.Email})
return user, errors.New("invalid password")
}
Expand Down
4 changes: 2 additions & 2 deletions core/sessions/localauth/orm.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -156,7 +156,7 @@ func (o *orm) CreateSession(ctx context.Context, sr sessions.SessionRequest) (st
return "", pkgerrors.New("Invalid email")
}

if !utils.CheckPasswordHash(sr.Password, user.HashedPassword) {
if !utils.CheckPasswordHash(sr.Password, string(user.HashedPassword)) {
o.auditLogger.Audit(audit.AuthLoginFailedPassword, map[string]any{"email": sr.Email})
return "", pkgerrors.New("Invalid password")
}
Expand Down Expand Up @@ -249,7 +249,7 @@ func (o *orm) ClearNonCurrentSessions(ctx context.Context, sessionID string) err
// CreateUser creates a new API user
func (o *orm) CreateUser(ctx context.Context, user *sessions.User) error {
sql := "INSERT INTO users (email, hashed_password, role, created_at, updated_at) VALUES ($1, $2, $3, now(), now()) RETURNING *"
return o.ds.GetContext(ctx, user, sql, strings.ToLower(user.Email), user.HashedPassword, user.Role)
return o.ds.GetContext(ctx, user, sql, strings.ToLower(user.Email), string(user.HashedPassword), user.Role)
}

// UpdateRole overwrites role field of the user specified by email.
Expand Down
2 changes: 1 addition & 1 deletion core/sessions/oidcauth/oidc.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -584,7 +584,7 @@ func (oi *oidcAuthenticator) localLoginFallback(ctx context.Context, sr clsessio
return user, errors.New("invalid email")
}

if !utils.CheckPasswordHash(sr.Password, user.HashedPassword) {
if !utils.CheckPasswordHash(sr.Password, string(user.HashedPassword)) {
oi.auditLogger.Audit(audit.AuthLoginFailedPassword, map[string]any{"email": sr.Email})
return user, errors.New("invalid password")
}
Expand Down
18 changes: 9 additions & 9 deletions core/sessions/oidcauth/oidc_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -53,7 +53,7 @@ func TestORM_FindUser_Single(t *testing.T) {

// create user
sql := "INSERT INTO users (email, hashed_password, role, created_at, updated_at) VALUES ($1, $2, $3, now(), now()) RETURNING *"
_, err := db.ExecContext(ctx, sql, strings.ToLower(user1.Email), user1.HashedPassword, user1.Role)
_, err := db.ExecContext(ctx, sql, strings.ToLower(user1.Email), string(user1.HashedPassword), user1.Role)
require.NoError(t, err)

// Find user
Expand Down Expand Up @@ -140,7 +140,7 @@ func TestORM_ListUsers(t *testing.T) {
for _, u := range users {
// create user
sql := "INSERT INTO users (email, hashed_password, role, created_at, updated_at) VALUES ($1, $2, $3, now(), now()) RETURNING *"
_, err := db.ExecContext(ctx, sql, strings.ToLower(u.Email), u.HashedPassword, u.Role)
_, err := db.ExecContext(ctx, sql, strings.ToLower(u.Email), string(u.HashedPassword), u.Role)
require.NoError(t, err)
}

Expand Down Expand Up @@ -170,7 +170,7 @@ func TestORM_CreateSession(t *testing.T) {

// create user
sql := "INSERT INTO users (email, hashed_password, role, created_at, updated_at) VALUES ($1, $2, $3, now(), now()) RETURNING *"
_, err := db.ExecContext(ctx, sql, strings.ToLower(user1.Email), user1.HashedPassword, user1.Role)
_, err := db.ExecContext(ctx, sql, strings.ToLower(user1.Email), string(user1.HashedPassword), user1.Role)
require.NoError(t, err)

// create session for the user
Expand All @@ -190,7 +190,7 @@ func TestORM_DeleteSession(t *testing.T) {

// create user
sql := "INSERT INTO users (email, hashed_password, role, created_at, updated_at) VALUES ($1, $2, $3, now(), now()) RETURNING *"
_, err := db.ExecContext(ctx, sql, strings.ToLower(user1.Email), user1.HashedPassword, user1.Role)
_, err := db.ExecContext(ctx, sql, strings.ToLower(user1.Email), string(user1.HashedPassword), user1.Role)
require.NoError(t, err)

// create session for the user
Expand All @@ -213,7 +213,7 @@ func TestORM_ClearNonConcurrentSession(t *testing.T) {

// create user
sql := "INSERT INTO users (email, hashed_password, role, created_at, updated_at) VALUES ($1, $2, $3, now(), now()) RETURNING *"
_, err := db.ExecContext(ctx, sql, strings.ToLower(user1.Email), user1.HashedPassword, user1.Role)
_, err := db.ExecContext(ctx, sql, strings.ToLower(user1.Email), string(user1.HashedPassword), user1.Role)
require.NoError(t, err)

// create session for the user
Expand All @@ -236,7 +236,7 @@ func Test_AuthorizeUserWithSession_Success(t *testing.T) {

// create user
sql := "INSERT INTO users (email, hashed_password, role, created_at, updated_at) VALUES ($1, $2, $3, now(), now()) RETURNING *"
_, err := db.ExecContext(ctx, sql, strings.ToLower(user1.Email), user1.HashedPassword, user1.Role)
_, err := db.ExecContext(ctx, sql, strings.ToLower(user1.Email), string(user1.HashedPassword), user1.Role)
require.NoError(t, err)

// create session for the user
Expand Down Expand Up @@ -264,7 +264,7 @@ func Test_AuthorizeUserWithSession_Expired(t *testing.T) {

// create user
sql := "INSERT INTO users (email, hashed_password, role, created_at, updated_at) VALUES ($1, $2, $3, now(), now()) RETURNING *"
_, err := db.ExecContext(ctx, sql, strings.ToLower(user1.Email), user1.HashedPassword, user1.Role)
_, err := db.ExecContext(ctx, sql, strings.ToLower(user1.Email), string(user1.HashedPassword), user1.Role)
require.NoError(t, err)

// create session for the user
Expand Down Expand Up @@ -294,7 +294,7 @@ func Test_AuthorizeUserWithSession_SessionRoleMatchesUserRole(t *testing.T) {

// create user
sql := "INSERT INTO users (email, hashed_password, role, created_at, updated_at) VALUES ($1, $2, $3, now(), now()) RETURNING *"
_, err := db.ExecContext(ctx, sql, strings.ToLower(user1.Email), user1.HashedPassword, sessions.UserRoleView)
_, err := db.ExecContext(ctx, sql, strings.ToLower(user1.Email), string(user1.HashedPassword), sessions.UserRoleView)
require.NoError(t, err)

// create session for the user
Expand All @@ -320,7 +320,7 @@ func TestORM_CreateSession_LocalAdminFallbackLogin(t *testing.T) {

// create user
sql := "INSERT INTO users (email, hashed_password, role, created_at, updated_at) VALUES ($1, $2, $3, now(), now()) RETURNING *"
_, err := db.ExecContext(ctx, sql, strings.ToLower(user1.Email), user1.HashedPassword, "admin")
_, err := db.ExecContext(ctx, sql, strings.ToLower(user1.Email), string(user1.HashedPassword), "admin")
require.NoError(t, err)

// create session with correct password, expect ok
Expand Down
5 changes: 3 additions & 2 deletions core/sessions/user.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,13 +8,14 @@ import (
pkgerrors "github.com/pkg/errors"
"gopkg.in/guregu/null.v4"

"github.com/smartcontractkit/chainlink-common/pkg/config"
"github.com/smartcontractkit/chainlink/v2/core/utils"
)

// User holds the credentials for API user.
type User struct {
Email string
HashedPassword string
HashedPassword config.SecretString
Role UserRole
CreatedAt time.Time
TokenKey null.String
Expand Down Expand Up @@ -50,7 +51,7 @@ func NewUser(email string, plainPwd string, role UserRole) (User, error) {

return User{
Email: email,
HashedPassword: pwd,
HashedPassword: *config.NewSecretString(pwd),
Role: role,
}, nil
}
Expand Down
13 changes: 7 additions & 6 deletions core/web/resolver/api_token_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,6 +9,7 @@ import (
"github.com/stretchr/testify/mock"
"github.com/stretchr/testify/require"

"github.com/smartcontractkit/chainlink-common/pkg/config"
"github.com/smartcontractkit/chainlink/v2/core/auth"
"github.com/smartcontractkit/chainlink/v2/core/utils"
webauth "github.com/smartcontractkit/chainlink/v2/core/web/auth"
Expand Down Expand Up @@ -61,7 +62,7 @@ func TestResolver_CreateAPIToken(t *testing.T) {
pwd, err := utils.HashPassword(defaultPassword)
require.NoError(t, err)

session.User.HashedPassword = pwd
session.User.HashedPassword = *config.NewSecretString(pwd)

f.Mocks.authProvider.On("FindUser", mock.Anything, session.User.Email).Return(*session.User, nil)
f.Mocks.authProvider.On("TestPassword", mock.Anything, session.User.Email, defaultPassword).Return(nil)
Expand Down Expand Up @@ -119,7 +120,7 @@ func TestResolver_CreateAPIToken(t *testing.T) {
pwd, err := utils.HashPassword(defaultPassword)
require.NoError(t, err)

session.User.HashedPassword = pwd
session.User.HashedPassword = *config.NewSecretString(pwd)

f.Mocks.authProvider.On("FindUser", mock.Anything, session.User.Email).Return(*session.User, gError)
f.App.On("AuthenticationProvider").Return(f.Mocks.authProvider)
Expand Down Expand Up @@ -147,7 +148,7 @@ func TestResolver_CreateAPIToken(t *testing.T) {
pwd, err := utils.HashPassword(defaultPassword)
require.NoError(t, err)

session.User.HashedPassword = pwd
session.User.HashedPassword = *config.NewSecretString(pwd)

f.Mocks.authProvider.On("FindUser", mock.Anything, session.User.Email).Return(*session.User, nil)
f.Mocks.authProvider.On("TestPassword", mock.Anything, session.User.Email, defaultPassword).Return(nil)
Expand Down Expand Up @@ -217,7 +218,7 @@ func TestResolver_DeleteAPIToken(t *testing.T) {
pwd, err := utils.HashPassword(defaultPassword)
require.NoError(t, err)

session.User.HashedPassword = pwd
session.User.HashedPassword = *config.NewSecretString(pwd)
err = session.User.TokenKey.UnmarshalText([]byte("new-access-key"))
require.NoError(t, err)

Expand Down Expand Up @@ -273,7 +274,7 @@ func TestResolver_DeleteAPIToken(t *testing.T) {
pwd, err := utils.HashPassword(defaultPassword)
require.NoError(t, err)

session.User.HashedPassword = pwd
session.User.HashedPassword = *config.NewSecretString(pwd)

f.Mocks.authProvider.On("FindUser", mock.Anything, session.User.Email).Return(*session.User, gError)
f.App.On("AuthenticationProvider").Return(f.Mocks.authProvider)
Expand Down Expand Up @@ -301,7 +302,7 @@ func TestResolver_DeleteAPIToken(t *testing.T) {
pwd, err := utils.HashPassword(defaultPassword)
require.NoError(t, err)

session.User.HashedPassword = pwd
session.User.HashedPassword = *config.NewSecretString(pwd)

f.Mocks.authProvider.On("FindUser", mock.Anything, session.User.Email).Return(*session.User, nil)
f.Mocks.authProvider.On("TestPassword", mock.Anything, session.User.Email, defaultPassword).Return(nil)
Expand Down
2 changes: 1 addition & 1 deletion core/web/resolver/mutation.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -950,7 +950,7 @@ func (r *Resolver) UpdateUserPassword(ctx context.Context, args struct {
return nil, err
}

if !utils.CheckPasswordHash(args.Input.OldPassword, dbUser.HashedPassword) {
if !utils.CheckPasswordHash(args.Input.OldPassword, string(dbUser.HashedPassword)) {
r.App.GetAuditLogger().Audit(audit.PasswordResetAttemptFailedMismatch, map[string]any{"user": dbUser.Email})

return NewUpdatePasswordPayload(nil, map[string]string{
Expand Down
7 changes: 4 additions & 3 deletions core/web/resolver/user_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,6 +8,7 @@ import (
"github.com/stretchr/testify/mock"
"github.com/stretchr/testify/require"

"github.com/smartcontractkit/chainlink-common/pkg/config"
"github.com/smartcontractkit/chainlink/v2/core/utils"
"github.com/smartcontractkit/chainlink/v2/core/web/auth"
)
Expand Down Expand Up @@ -53,7 +54,7 @@ func TestResolver_UpdateUserPassword(t *testing.T) {
pwd, err := utils.HashPassword(oldPassword)
require.NoError(t, err)

session.User.HashedPassword = pwd
session.User.HashedPassword = *config.NewSecretString(pwd)

Comment thread
pavel-raykov marked this conversation as resolved.
f.Mocks.authProvider.On("FindUser", mock.Anything, session.User.Email).Return(*session.User, nil)
f.Mocks.authProvider.On("SetPassword", mock.Anything, session.User, "new").Return(nil)
Expand Down Expand Up @@ -108,7 +109,7 @@ func TestResolver_UpdateUserPassword(t *testing.T) {
pwd, err := utils.HashPassword(oldPassword)
require.NoError(t, err)

session.User.HashedPassword = pwd
session.User.HashedPassword = *config.NewSecretString(pwd)

f.Mocks.authProvider.On("FindUser", mock.Anything, session.User.Email).Return(*session.User, nil)
f.Mocks.authProvider.On("ClearNonCurrentSessions", mock.Anything, session.SessionID).Return(
Expand Down Expand Up @@ -139,7 +140,7 @@ func TestResolver_UpdateUserPassword(t *testing.T) {
pwd, err := utils.HashPassword(oldPassword)
require.NoError(t, err)

session.User.HashedPassword = pwd
session.User.HashedPassword = *config.NewSecretString(pwd)

f.Mocks.authProvider.On("FindUser", mock.Anything, session.User.Email).Return(*session.User, nil)
f.Mocks.authProvider.On("ClearNonCurrentSessions", mock.Anything, session.SessionID).Return(nil)
Expand Down
2 changes: 1 addition & 1 deletion core/web/user_controller.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -222,7 +222,7 @@ func (u *UserController) UpdatePassword(c *gin.Context) {
jsonAPIError(c, http.StatusInternalServerError, errors.New("unable to update password"))
return
}
if !utils.CheckPasswordHash(request.OldPassword, user.HashedPassword) {
if !utils.CheckPasswordHash(request.OldPassword, string(user.HashedPassword)) {
u.App.GetAuditLogger().Audit(audit.PasswordResetAttemptFailedMismatch, map[string]any{"user": user.Email})
jsonAPIError(c, http.StatusConflict, errors.New("old password does not match"))
return
Expand Down
Loading