1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
|
package player
import (
"strings"
"testing"
)
func TestHashPasswordUsesArgon2idAndVerifies(t *testing.T) {
hash, err := HashPassword("secret password")
if err != nil {
t.Fatal(err)
}
if !strings.HasPrefix(hash, "argon2id:") {
t.Fatalf("hash format = %q, want argon2id", hash)
}
if !CheckPassword("secret password", hash) {
t.Fatal("correct password rejected")
}
if CheckPassword("wrong password", hash) {
t.Fatal("wrong password accepted")
}
// Salts must be unique per call: two hashes of the same password differ.
other, _ := HashPassword("secret password")
if other == hash {
t.Fatal("two hashes of the same password are identical (salt reuse)")
}
}
func TestCheckPasswordRejectsGarbage(t *testing.T) {
for _, stored := range []string{
"",
"plain",
"argon2id:1:2:3:no-salt:zz",
"unknown:v1:salt:deadbeef",
// Legacy single-pass SHA-256 hashes are no longer accepted.
"sha256:AAAAAAAAAAAAAAAAAAAAAA:0011223344556677889900112233445566778899001122334455667788990011",
} {
if CheckPassword("anything", stored) {
t.Fatalf("garbage hash accepted: %q", stored)
}
}
}
|
