Repository navigation
Store password for REST API feature as Argon2 hash instead of clear text. #198
Description
It would be great to enhance the security of the REST API feature by hashing the password in the application.properties as an Argon2 hash.
I know this is not a high security context. Still I would feel better if secrets are encoded. Because why do you even have authentication if the credentials are not stored safely.
Activity
#198: Add Argon2 password encoding.
mplieske commentedon Nov 26, 2025
I created PR #199 for this issue.
mplieske commentedon Dec 2, 2025
I spotted one issue here.
The configuration screen reads the password from the application.properties and loads it into the view. If you already have a configuration for the REST API feature and you want to change something, eg the port, the already hashed password will be hashed and saved.
I will provide a fix for this in the coming days.
Probably we should only save a password if provided a new one and we should not load the password from the application.properties into the view.
In case of no password being present in the application.properties we could display a warning.