#0702
A password hashing function accepts a salt parameter but silently ignores it. Every call with the same password produces the same hash regardless of the salt provided.
Without salts, identical passwords produce identical hashes. An attacker with the hash database can use pre-computed rainbow tables to crack all matching passwords in one pass.
The fix is simple: include the salt in the hashed output so that even identical passwords produce unique hashes.
Salts ensure that identical passwords hash to different values, defeating pre-computed rainbow table attacks. Without salts, a single cracked hash exposes every user with the same password.
hashPassword so it incorporates the salt in the returned hash.hash field must differ when the same password is hashed with different salts.hashPassword('pass', 'salt1') // → { hash: 'hash:pass' }hashPassword('pass', 'salt2') // → { hash: 'hash:pass' }// identical! rainbow table attack works
hashPassword('pass', 'salt1') // → { hash: 'hash:salt1:pass' }hashPassword('pass', 'salt2') // → { hash: 'hash:salt2:pass' }
{ hash: string }."hash:" + salt + ":" + password.