Rails 7.1: Dockerfiles, BYO Authentication, More Async Queries, and More | Hacker News Reader

Rails 7.1: Dockerfiles, BYO Authentication, More Async Queries, and More

rubyonrails.org

18 pointsksec5 comments

What is a good way to generate a password reset token? Is this even close to standard?

  generates_token_for :password_reset, expires_in: 15.minutes do
    # Last 10 characters of password salt, which changes when password is updated:
    password_salt&.last(10)
  end

Using a value that can be known externally -- because it is saved in plain text in the database, which I assume has been, will be, and is being breached -- seems like a security hole.

If an attacker has plain text access to the database, they likely don’t care about resetting a password to gain access to a user’s account.

It's more an assumption I make to help guide how I build applications. Put another way, I wouldn't bother hashing the user password if I expected that I would always perfectly prevent all unauthorized reads from the database.

If someone knows that my application will just use the last 10 characters of the salt for a password reset token and they initiate the password reset for a user, they can potentially use the data from last month's breach to reset a user's password.

The token is further hashed with the application secret key the same way any token would be.

Interesting that they added builtin support for Bun.

> You can now generate new applications using Bun as your JavaScript runtime. To do so, you can pass the --javascript=bun option to rails new.

Reply on news.ycombinator.com