Fix broken cryptographic primitive protecting a secret in SvelteKit

A hash, cipher, or random source that cannot carry the weight it has been given: MD5 or SHA-1 over a password, a DES or ECB cipher, or Math.random() producing a token. Each has a drop-in replacement in the standard library, so the fix is small - the cost of not making it is that the protection is decorative.

high likely SvelteKit CWE-327 / OWASP A02:2021

The vulnerable pattern in SvelteKit

This finding comes from the SvelteKit fixture in the owlwarden test suite. This hash is fast, and speed is the attacker's advantage: a commodity GPU tries billions of candidates a second, so a leaked table of these hashes is a leaked table of the values behind them. Password hashing needs a deliberately slow algorithm with a per-value salt.

The corrected handler

Replace the primitive in the server module; there is no hook for this.

import { randomBytes, randomUUID, scrypt } from 'node:crypto'

// Tokens and session ids: unpredictable, not merely random-looking.
const sessionId = randomUUID()
const resetToken = randomBytes(32).toString('base64url')

// Passwords: a slow hash with a per-password salt. bcrypt and argon2 are
// equally correct; scrypt needs no dependency.
const salt = randomBytes(16)
const hash = await new Promise<Buffer>((resolve, reject) =>
  scrypt(password, salt, 64, (error, key) => (error ? reject(error) : resolve(key))),
)

On a different runtime

The fix above is written for the runtime SvelteKit usually runs on. These are the runtimes where it would not run at all - an import that does not exist, or an API the host does not have - and what to write instead.

Workers and other fetch-API runtimes

There is no node:crypto on this runtime. Use the Web Crypto API, which is global. scrypt has no equivalent; PBKDF2 with a high iteration count is the replacement.

// No node:crypto here - this is the Web Crypto API, which every
// fetch-API runtime exposes globally as `crypto`.

// Tokens and session ids.
const sessionId = crypto.randomUUID()
const resetToken = btoa(String.fromCharCode(...crypto.getRandomValues(new Uint8Array(32))))
  .replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '')

// Passwords: scrypt is not available. PBKDF2 is, and needs a high
// iteration count to be worth anything.
const salt = crypto.getRandomValues(new Uint8Array(16))
const key = await crypto.subtle.importKey('raw', new TextEncoder().encode(password),
  'PBKDF2', false, ['deriveBits'])
const hash = await crypto.subtle.deriveBits(
  { name: 'PBKDF2', salt, iterations: 600_000, hash: 'SHA-256' }, key, 256,
)

If you are not using SvelteKit

Use a slow, salted hash for passwords and a cryptographic random source for tokens. Both are in the Node standard library; neither needs a dependency.

Check your own repository

npx owlwarden scan
npx owlwarden explain weak-crypto

Runs on your machine. No account, no telemetry, no network unless you ask. In CI, SARIF uploads to code scanning and the exit code is the gate.

Other SvelteKit checks

Rules with a tested SvelteKit example.

• cors-permissive medium Cross-origin policy accepts any origin
• hardcoded-secret high Credential hardcoded in source
• insecure-cookie medium Cookie set without its protective attributes
• install-lifecycle-script medium Package declares an install-time script
• open-redirect medium Redirect target comes from the caller
• security-headers-missing medium Security headers are not configured
• sensitive-data-logged medium Sensitive data written to a log
• sql-injection high SQL query built by string interpolation
• ssrf high Server fetches a URL the caller controls
• stack-trace-leak high Stack trace leaked in error response

weak-crypto for every framework / All rules / owlwarden