Skip to main content

Function: normalizePasswordSubmission()

normalizePasswordSubmission(value, userUid, config): Promise<string>

Defined in: auth/src/auth/shared.ts:1134

Normalizes a submitted password value to the canonical form that should be fed into the server's own Argon2id hash (on create/change-password) or verify (on login) call, regardless of whether the submitting client hashed it locally first:

  • Already client-hashed (matches isClientHashedFormat()): returned unchanged, once its embedded cost parameters are confirmed to meet config's configured minimum (throws WeakClientHashError otherwise).
  • Raw plaintext: hashed here, using the same fixed salt derivation and parameters a capable client would have used (deriveClientSalt(userUid) + CLIENT_ARGON2_PARAMS), so a legacy/incapable client's submission normalizes to what a capable client's submission of the same password would have been — letting a single stored hash (see BaseSecretRoute) accept logins from either kind of client.

Parameters​

value​

string

The raw value submitted by the client — either a plaintext password or an already client-hashed value.

userUid​

string

The uid of the account this password belongs to, used to derive the salt for the plaintext fallback path.

config​

PasswordConfig

Supplies the minimum accepted client-hash cost parameters.

Returns​

Promise<string>