Example `with-prisma` stores passwords as clear text in the database
Nobody has claimed this yet.
- Dominant language
- TypeScript
- Stars
- 539
- Forks
- 129
- Avg merge
- 23h 46m
- Merged PRs (30d)
- 23
Description
Hi folks,
I just tried out the with-prisma example and noticed that the user password is stored without be hashed.
In my opinion this is a major problem, because it teaches new users (which are likely to use templates like this one) insecure practices. Like back in the day when all SQL examples were done without prepared statements.
I would suggest adding a modern hash function like argon2id or scrypt. If you folks agree, I would create a PR.
Thanks for all the hard work!
meldron
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Locate the with-prisma example and trace where user passwords are written to the database. Review the issue discussion before choosing between argon2id and scrypt; done means the example no longer stores passwords as clear text while preserving its documented behavior.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- typescript
- Domain
- databases, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 32/100