starred/audiobookshelf
1
0
Fork 0
mirror of https://github.com/advplyr/audiobookshelf.git synced 2026-05-30 23:40:40 +02:00
Code Issues 1.0k Packages Projects Releases 10 Wiki Activity

[PR #5084] Add config for bcrypt cost, default to 12 instead of 8. #4419

New Issue
Open
opened 2026-04-25 00:19:40 +02:00 by adam · 0 comments
adam commented 2026-04-25 00:19:40 +02:00
Owner
Copy Link
Copy Source

📋 Pull Request Information

Original PR: https://github.com/advplyr/audiobookshelf/pull/5084
Author: @AndrolGenhald
Created: 2/26/2026
Status: 🔄 Open

Base: master ← Head: bcrypt-cost-config

📝 Commits (1)

  • f35f218 Add config for bcrypt cost, default to 12 instead of 8.

📊 Changes

1 file changed (+17 additions, -1 deletions)

View changed files

📝 server/auth/LocalAuthStrategy.js (+17 -1)

📄 Description

Brief summary

Allow configuring bcrypt cost, default to 12 instead of 8.

In-depth Description

The recommended cost for bcrypt these days is usually 12, with 10 being the recommendation from over a decade ago. This PR adds an environment variable BCRYPT_COST to configure the bcrypt cost, with a minimum of 8.

I was unable to find any source for the documentation here, so that will need to be updated separately. I recommend updating it with:

  • BCRYPT_COST (default: 12)
    • This influences the time it takes to hash passwords when logging in; increasing by 1 doubles how long it takes.
    • It is recommended to leave it at the default, or, if it takes too long to log in, decrease it by 1 until logging in takes less than half a second (note that each user's first login after changing will take extra long to re-hash using the new cost).

How have you tested this?

Created several users, logged in after changing bcrypt cost, changed passwords after changing bcrypt cost again.

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/advplyr/audiobookshelf/pull/5084 **Author:** [@AndrolGenhald](https://github.com/AndrolGenhald) **Created:** 2/26/2026 **Status:** 🔄 Open **Base:** `master` ← **Head:** `bcrypt-cost-config` --- ### 📝 Commits (1) - [`f35f218`](https://github.com/advplyr/audiobookshelf/commit/f35f218c0fc3f08ad615aa96010bc470f4ece5e5) Add config for bcrypt cost, default to 12 instead of 8. ### 📊 Changes **1 file changed** (+17 additions, -1 deletions) <details> <summary>View changed files</summary> 📝 `server/auth/LocalAuthStrategy.js` (+17 -1) </details> ### 📄 Description ## Brief summary Allow configuring bcrypt cost, default to 12 instead of 8. ## In-depth Description The recommended cost for bcrypt these days is usually 12, with 10 being the recommendation from over a decade ago. This PR adds an environment variable `BCRYPT_COST` to configure the bcrypt cost, with a minimum of 8. I was unable to find any source for the documentation [here](https://www.audiobookshelf.org/docs/#security), so that will need to be updated separately. I recommend updating it with: - `BCRYPT_COST` (default: `12`) - This influences the time it takes to hash passwords when logging in; increasing by 1 doubles how long it takes. - It is recommended to leave it at the default, or, if it takes too long to log in, decrease it by 1 until logging in takes less than half a second (note that each user's first login after changing will take extra long to re-hash using the new cost). ## How have you tested this? Created several users, logged in after changing bcrypt cost, changed passwords after changing bcrypt cost again. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
adam added the pull-request label 2026-04-25 00:19:40 +02:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
authentication
backlog
bug
chapter editor
config-issue
ebooks
encoding/embedding
enhancement
help wanted
listening sessions & progress
planned
possible plugin
progress sync
pull-request
Mirrored from GitHub Pull Request
 sorting/filtering/searching
unable to reproduce
upload
users & permissions
waiting
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
adam (Adam Melkus)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/audiobookshelf#4419
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?