nickva commented on code in PR #4814:
URL: https://github.com/apache/couchdb/pull/4814#discussion_r1388693671
##########
src/couch/src/couch_httpd_auth.erl:
##########
@@ -662,10 +643,14 @@ authenticate(Pass, UserProps) ->
couch_util:get_value(<<"password_sha">>, UserProps, nil)
};
<<"pbkdf2">> ->
+ PRF = couch_util:get_value(<<"pbkdf2_prf">>, UserProps,
<<"sha">>),
+ verify_prf(PRF),
Iterations = couch_util:get_value(<<"iterations">>, UserProps,
10000),
Review Comment:
That is an odd one... did we ever make a release which always assumed a
hard-code iterations value of 10000, if there is a slight chance we did, we
should probably keep the value as is. If you recall better and there is no
chance we'd actually rely on that default 10000 then maybe doing the
`undefined` or `nil` verification would make sense.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
