Insecure password storage

[st161848]

Password hashes are created with crypto.createHmac(passwordAlgorithm, passwordSecret).update(password), which is not a secure way of storing passwords.

Notably, two users who have the same password will share the same password hash:

ccims=# select (username, pw_hash) from users;
                             row
-------------------------------------------------------------
 (test1,sha256;6UBguf6xoaDCi0HsGx8JoP32WrJoXKmSwghTr23buH4=)
 (test2,sha256;6UBguf6xoaDCi0HsGx8JoP32WrJoXKmSwghTr23buH4=)
(2 rows)

Instead, passwords should be stored with a random salt and an intentionally expensive validation function such as PBKDF2. Using a password secret is probably not necessary.

[nk-coding]

@ModellbahnFreak fyi
Currently, the authentication part of CCIMS is highly problematic, not only from a security standpoint, but also from a usability standpoint.
Therefore, we plan to switch to a dedicated authentication server in the near future, probably using the OpenID Connect protocol.