Document issue type
Type/Bug (Report inaccuracies, outdated information, or missing details in the existing content)
Description
The "Password Hashing" section in docs/content/deployment/configuration.mdx (around lines 766-773) does not reflect what the backend actually supports.
Missing algorithms: The backend (backend/internal/system/cryptolib/hash.go) supports three selectable password hashing algorithms via crypto.password_hashing.algorithm: SHA256, PBKDF2, and ARGON2ID. The docs only describe PBKDF2, with no mention that SHA256 or ARGON2ID are valid, configurable alternatives.
Wrong / stale field paths: The docs list generic parameters under crypto.password_hashing.parameters.* (iterations, key_size, salt_size). The actual shipped config (backend/cmd/server/config/default.json) nests parameters per algorithm instead:
crypto.password_hashing.sha256.salt_sizecrypto.password_hashing.pbkdf2.{iterations,key_size,salt_size}crypto.password_hashing.argon2id.{iterations,memory,parallelism,key_size,salt_size}
Argon2id's memory and parallelism parameters aren't documented at all.
No explanatory content: There's no prose explaining what each algorithm is, its security tradeoffs, or guidance on when/why to choose one over another (e.g. why PBKDF2 is the shipped default, when Argon2id may be preferable, and any caveats around SHA256).
Suggested fix
- Update the "Password Hashing" table in
docs/content/deployment/configuration.mdx to list all three algorithms and their correct, per-algorithm parameter paths and defaults.
- Add a short explanation of each algorithm (SHA256, PBKDF2, Argon2id) and guidance on choosing between them.
Version
v1.0.0
Document issue type
Type/Bug (Report inaccuracies, outdated information, or missing details in the existing content)
Description
The "Password Hashing" section in
docs/content/deployment/configuration.mdx(around lines 766-773) does not reflect what the backend actually supports.Missing algorithms: The backend (
backend/internal/system/cryptolib/hash.go) supports three selectable password hashing algorithms viacrypto.password_hashing.algorithm:SHA256,PBKDF2, andARGON2ID. The docs only describePBKDF2, with no mention thatSHA256orARGON2IDare valid, configurable alternatives.Wrong / stale field paths: The docs list generic parameters under
crypto.password_hashing.parameters.*(iterations,key_size,salt_size). The actual shipped config (backend/cmd/server/config/default.json) nests parameters per algorithm instead:crypto.password_hashing.sha256.salt_sizecrypto.password_hashing.pbkdf2.{iterations,key_size,salt_size}crypto.password_hashing.argon2id.{iterations,memory,parallelism,key_size,salt_size}Argon2id's
memoryandparallelismparameters aren't documented at all.No explanatory content: There's no prose explaining what each algorithm is, its security tradeoffs, or guidance on when/why to choose one over another (e.g. why PBKDF2 is the shipped default, when Argon2id may be preferable, and any caveats around SHA256).
Suggested fix
docs/content/deployment/configuration.mdxto list all three algorithms and their correct, per-algorithm parameter paths and defaults.Version
v1.0.0