Password Reset Token with Oslo and not Lucia

[rwieruch]

The old documentation, if I recall correctly, had the following implementation for creating a password reset token:

// old
import { generateId } from "lucia";
import { sha256 } from "oslo/crypto";
import { encodeHex } from "oslo/encoding";

...

const tokenId = generateId(40);
const tokenHash = encodeHex(
  await sha256(new TextEncoder().encode(tokenId))
);

If I only want to use Oslo, would this translate to the following?

// new
import { sha256 } from "@oslojs/crypto/sha2";
import {
  encodeBase32LowerCaseNoPadding,
  encodeHexLowerCase,
} from "@oslojs/encoding";

const generateRandomToken = () => {
  const bytes = new Uint8Array(20);
  crypto.getRandomValues(bytes);
  return encodeBase32LowerCaseNoPadding(bytes);
};

const tokenId = generateRandomToken();
const tokenHash = encodeHex(
  sha256(new TextEncoder().encode(tokenId))
);

Perhaps I should also replace encodeHex with encodeHexLowerCase as it is shown for the session token in the new Lucia docs, correct?

And then I would store the token in my DB for later usage (as before) and generate the passwordResetLink with the tokenId (as before):

// new
await prisma.passwordResetToken.create({
  data: {
    tokenHash,
    userId,
    // expiresAt: createDate(new TimeSpan(2, "h")), old
    expiresAt: new Date(Date.now() + 2 * 60 * 60 * 1000),
  },
});

const pageUrl = getBaseUrl() + passwordResetPath();
const passwordResetLink = pageUrl + `/${tokenId}`;

Would this be correct?

[sunnypatell]

@rwieruch your migration looks almost right, just a couple of small things to fix:

1. encodeBase32LowerCaseNoPadding for the token ID is totally fine. it's equivalent to what generateId(40) did before (random bytes encoded to a string). the exact encoding doesn't matter as long as it's URL-safe and unique.

2. yes, replace encodeHex with encodeHexLowerCase from @oslojs/encoding. this matches what the new lucia docs use for session token hashing.

3. the sha256 from @oslojs/crypto/sha2 returns a Uint8Array directly (not a Promise<ArrayBuffer> like the old oslo/crypto). so you should drop the await:

import { sha256 } from '@oslojs/crypto/sha2';
import { encodeHexLowerCase } from '@oslojs/encoding';

// generating the token:
const tokenId = encodeBase32LowerCaseNoPadding(crypto.getRandomValues(new Uint8Array(20)));

// hashing for storage (no await needed):
const tokenHash = encodeHexLowerCase(sha256(new TextEncoder().encode(tokenId)));

4. new Date(Date.now() + 2 * 60 * 60 * 1000) is a correct replacement for createDate(new TimeSpan(2, "h")).

the overall pattern (hash the token, store the hash, send the raw tokenId in the link, re-hash on verification) is correct.

ref: lucia v3 password reset guide, @oslojs/crypto docs