Improve password security by adding pepper to hash

.env.docker

@@ -15,6 +15,7 @@ APP_URL=http://localhost:3000
 COOKIE_DOMAIN=localhost
 COOKIE_SECRET=super-secret-here
 JWT_SECRET=super-secret-here
+HASH_PEPPER=super-pepper-here
 
 # E-mails
 EMAIL_PROVIDER=none

.env.example

@@ -15,6 +15,7 @@ APP_URL="http://localhost:3000"
 COOKIE_DOMAIN="localhost"
 COOKIE_SECRET="super-secret-here"
 JWT_SECRET="super-secret-here"
+HASH_PEPPER="super-pepper-here"
 
 # E-mails
 EMAIL_PROVIDER="none"

.env.test

@@ -15,6 +15,7 @@ APP_URL="http://localhost:3000"
 COOKIE_DOMAIN="localhost"
 COOKIE_SECRET="test-cookie-secret-key-for-testing-only"
 JWT_SECRET="test-jwt-secret-key-for-testing-only"
+HASH_PEPPER="super-pepper-here"
 
 # E-mails
 EMAIL_PROVIDER="none"

src/app/cryptography/crypography.service.ts

@@ -1,3 +1,5 @@
+import { createHmac } from 'node:crypto';
+
 import { Injectable } from '@nestjs/common';
 import { JwtService } from '@nestjs/jwt';
 import { compare, hash } from 'bcryptjs';
@@ -12,19 +14,26 @@ type SetCookieOptions = CookieOptions & {
 
 @Injectable()
 export class CryptographyService {
-  private readonly HASH_SALT_LENGTH = 10;
-
   constructor(
     private readonly jwtService: JwtService,
     private readonly envService: EnvService,
   ) {}
 
-  createHash(plain: string): Promise<string> {
-    return hash(plain, this.HASH_SALT_LENGTH);
+  async createHash(plain: string): Promise<string> {
+    const rounds = this.envService.get('NODE_ENV') === 'test' ? 1 : 14;
+    const plainWithPepper = this.applyPepper(plain);
+    return await hash(plainWithPepper, rounds);
+  }
+
+  async compareHash(plain: string, hash: string): Promise<boolean> {
+    const plainWithPepper = this.applyPepper(plain);
+    return await compare(plainWithPepper, hash);
   }
 
-  compareHash(plain: string, hash: string): Promise<boolean> {
-    return compare(plain, hash);
+  private applyPepper(value: string) {
+    const pepper = this.envService.get('HASH_PEPPER');
+    if (!pepper) return value;
+    return createHmac('sha256', pepper).update(value).digest('base64');
   }
 
   async verifyToken<Payload extends object>(token: string): Promise<Payload> {

src/env/env.ts

@@ -4,10 +4,10 @@ export const envSchema = z.object({
   // Environment
   NODE_ENV: z.enum(['production', 'development', 'homolog', 'test']),
   APP_ENVIRONMENT: z.enum(['lambda', 'docker', 'local']),
-  MAINTENANCE: z.enum(['true', 'false']).transform((val) => val === 'true'),
   ENABLE_NEST_LOGS: z
     .enum(['true', 'false'])
     .transform((val) => val === 'true'),
+  MAINTENANCE: z.enum(['true', 'false']).transform((val) => val === 'true'),
 
   // API
   API_BASE_URL: z.string().url().optional(),
@@ -20,6 +20,7 @@ export const envSchema = z.object({
   COOKIE_DOMAIN: z.string().min(1),
   COOKIE_SECRET: z.string().min(1),
   JWT_SECRET: z.string().min(1),
+  HASH_PEPPER: z.string().min(1),
 
   // Database
   DB_HOST: z.string().min(1),