ArangoDB v3.9 reached End of Life (EOL) and is no longer supported.
This documentation is outdated. Please see the most recent version at docs.arangodb.com
const createAuth = require('@arangodb/foxx/auth');
Authenticators allow implementing basic password mechanism using simple built-in hashing functions.
Creating an authenticator
Creates an authenticator.
An object with the following properties:
The hashing algorithm to use to create password hashes. The authenticator will be able to verify passwords against hashes using any supported hashing algorithm. This only affects new hashes created by the authenticator.
Note: PBKDF2 is more secure but also takes considerably more resources to compute, which will impact ArangoDB performance, especially when verifying/hashing multiple passwords at a time. If you need a secure authentication mechanism consider performing authentication outside the database or using a third-party identity provider that supports OAuth 1.0a or OAuth 2.0.
Length of the salts that will be generated for password hashes.
Also used as the key length for PBKDF2.
Can be used to scale the number of iterations for PBKDF2 hashes, lower means faster, higher means slower.
Note that when using PBKDF2 the number of iterations will be automatically scaled based on the number of milliseconds elapsed since 1 January 2000, the work factor can be used to adjust the result further as needed.
Returns an authenticator.
Creating authentication data objects
Creates an authentication data object for the given password with the following properties:
The method used to generate the hash.
A random salt used to generate this hash.
The hash string itself.
A password to hash.
Returns the authentication data object.
Validating passwords against authentication data objects
auth.verify([hash, [password]]): boolean
Verifies the given password against the given hash using a constant time string comparison.
A authentication data object generated with the create method.
A password to verify against the hash.
true if the hash matches the given password. Returns