v9.20.6: bcrypt salt cost from env var support added

README.md

@@ -61,6 +61,9 @@ export CGO_ENABLED=0
 exprot LOGS_DATABASE="postgresql://user:pass@localhost/logs?sslmode=disable"
 export DATABASE="postgresql://user:pass@localhost/postgres?sslmode=disable"
 
+# optional ENV_VARS
+export BCRYPT_COST=10 # default is 12
+
 # export is success you can run the project ✅
 go run -tags pq ./examples/base serve  
 
@@ -134,6 +137,9 @@ export CGO_ENABLED=0
 export LOGS_DATABASE="postgresql://user:pass@localhost/logs?sslmode=disable"
 export DATABASE="postgresql://user:pass@localhost/postgres?sslmode=disable"
 
+# optional ENV_VARS
+export BCRYPT_COST=10 # default is 12
+
 # run the application
 go run -tags pq main.go serve --http=0.0.0.0:8090
 ```

models/admin.go

@@ -2,6 +2,8 @@ package models
 
 import (
 	"errors"
+	"os"
+	"strconv"
 
 	"github.com/AlperRehaYAZGAN/postgresbase/tools/security"
 	"github.com/AlperRehaYAZGAN/postgresbase/tools/types"
@@ -47,8 +49,20 @@ func (m *Admin) SetPassword(password string) error {
 		return errors.New("The provided plain password is empty")
 	}
 
+	// !CHANGED: bcrypt salt amount is increased from 10 to 12 (old ersion: 10). Get it from env var
+	// get cost from env
+	cost := 12
+	costArg := os.Getenv("BCRYPT_COST")
+	if costArg != "" {
+		costAi, err := strconv.Atoi(costArg)
+		if err != nil {
+			return errors.New("The provided BCRYPT_COST is not a valid number")
+		}
+		cost = costAi
+	}
+
 	// hash the password
-	hashedPassword, err := bcrypt.GenerateFromPassword([]byte(password), 12)
+	hashedPassword, err := bcrypt.GenerateFromPassword([]byte(password), cost)
 	if err != nil {
 		return err
 	}

models/record.go

@@ -4,6 +4,7 @@ import (
 	"encoding/json"
 	"errors"
 	"fmt"
+	"os"
 	"regexp"
 	"strconv"
 	"time"
@@ -930,8 +931,20 @@ func (m *Record) SetPassword(password string) error {
 		return errors.New("The provided plain password is empty")
 	}
 
+	// !CHANGED: bcrypt salt amount is increased from 10 to 12 (old ersion: 10). Get it from env var
+	// get cost from env
+	cost := 12
+	costArg := os.Getenv("BCRYPT_COST")
+	if costArg != "" {
+		costAi, err := strconv.Atoi(costArg)
+		if err != nil {
+			return errors.New("The provided BCRYPT_COST is not a valid number")
+		}
+		cost = costAi
+	}
+
 	// hash the password
-	hashedPassword, err := bcrypt.GenerateFromPassword([]byte(password), 12)
+	hashedPassword, err := bcrypt.GenerateFromPassword([]byte(password), cost)
 	if err != nil {
 		return err
 	}