Salt passwords

[kthchew]

Problem To Be Solved

Passwords are currently hashed with SHA256, which is good. However, they should also be salted.

Motivation

This is a commonly used security measure that protects accounts from attacks involving rainbow tables, etc.

Proposed Solution

Append a salt randomly generated by the server to the end of the password before hashing upon account creation, and store the salt in the database.

Lunch_Buddies/api/login/login.go

Line 33 in 5c588f5

result, err := database.Execute(fmt.Sprintf("INSERT INTO Accounts (email, password) VALUES ('%s', SHA2('%s', 256))", acc.Email, acc.Password))