5 ms·
The external auth service's API would receive textual input (expecting a string read from a textbox), not binary. A hash that included null bytes would output t
by GormanFletcher 5y ago
The external auth service's API would receive textual input (expecting a string read from a textbox), not binary. A hash that included null bytes would output those in hex as ASCII zeroes, which wouldn't cause the same problem when the external service received the value.
- jlokier 5y agoAnd that is, in fact, how you should perform a hash before bcrypt as well. bcrypt accepts text input, not binary. So if you use a pre-hash, you pass the hex or base64 output from the hash to bcrypt.