gergely/taskwarrior-2.x
1
0
Fork 0
Code Issues Actions Packages Projects Releases 1 Wiki Activity

sync server: Don't hash client_id for salt (#3250)

Browse Source 
We don't know why we're doing this step so we probably shouldn't.
Cryptography isn't magic and extra steps are harmful in that they
obscure the important parts.
This commit is contained in:
ryneeverett
2024-01-21 18:16:25 -05:00
committed by GitHub
parent fa21835001
commit 082b6084fa
10 changed files with 11 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
taskchampion/docs/src/http.md
View File

@@ -6,7 +6,7 @@ The `origin` *should* be an HTTPS endpoint on general principle, but nothing in
The replica identifies itself to the server using a `client_id` in the form of a UUID.
This value is passed with every request in the `X-Client-Id` header, in its dashed-hex format.
The salt used in key derivation is the SHA256 hash of the 16-byte form of the client ID.
The salt used in key derivation is the 16-byte client ID.
## AddVersion