Argon2

MedusaJS Argon2 Authentication Plugin

🔐 Enhanced password hashing for MedusaJS using the Argon2 algorithm - the most advanced and secure password hashing method.

🌟 Features

• Utilizes Argon2, the winner of the Password Hashing Competition
• Highly configurable password hashing
• Provides robust protection against various password cracking techniques
• Seamless integration with MedusaJS authentication

🛡️ Why Argon2?

Argon2 offers superior security compared to traditional hashing methods:

• Resistant to GPU and ASIC cracking attempts
• Configurable memory, time, and parallelism costs
• Adaptable to changing computational power
• Recommended by leading security experts

📦 Installation

Install the package using npm:

npm install @vymalo/medusa-argon2

Or using yarn:

yarn add @vymalo/medusa-argon2

🚀 Usage

Add the plugin to the modules section of your MedusaJS configuration:

1modules: [
2  {
3    resolve: '@medusajs/medusa/auth',
4    options: {
5      providers: [
6        {
7          resolve: '@vymalo/medusa-argon2',
8          id: 'emailpass', // Yes, `emailpass`, as the goal is to override the default 
9          options: {
10            // Optional configuration parameters
11            argon2: {
12              timeCost: 3,
13              memoryCost: 12288, // 12 MB
14              parallelism: 1
15            }
16          },
17        },
18      ],
19    },
20  },
21  // Other modules...
22]

🔧 Configuration Options

The plugin supports full Argon2 configuration:

1interface Argon2Options {
2  hashLength?: number;      // Length of the hash output (default: secure)
3  timeCost?: number;        // Number of iterations (higher = more secure)
4  memoryCost?: number;      // Memory usage in KB (higher = more secure)
5  parallelism?: number;     // Number of parallel threads
6  type?: 0 | 1 | 2;         // Argon2 variant (d, i, or id)
7  version?: number;          // Argon2 version
8  
9  // Advanced options
10  salt?: Buffer;             // Custom salt (usually auto-generated)
11  associatedData?: Buffer;   // Additional context data
12  secret?: Buffer;           // Secret key for additional security
13}

Recommended Configuration

• timeCost: Minimum 3, increase for more security
• memoryCost: At least 12288 KB (12 MB)
• parallelism: 1-4 depending on your server
• type: Recommended 2 (Argon2id - hybrid mode)

🛡️ Security Recommendations

• Always use environment variables for sensitive configurations
• Periodically review and adjust hashing parameters
• Monitor computational resources and update costs as hardware evolves

🤝 Contributing

Contributions are welcome! Please submit pull requests or open issues.

🔒 Security Reporting

If you discover a security vulnerability, please send an email to [your security contact].

📄 License

Check the license

🔗 Related Projects

• MedusaJS
• Argon2 Specification