From dc3915a4e38e3d05265ad44c66ce40a0f013a7ba Mon Sep 17 00:00:00 2001 From: diegosouzapw Date: Fri, 29 May 2026 08:16:48 -0300 Subject: [PATCH] docs(security): explain SHA-256 cache-key rationale in inner-ai The tokenCacheKey() SHA-256 digest is an in-memory cache key derived from the session token, not password-at-rest storage. Document why CWE-916 KDFs (bcrypt/scrypt/Argon2) are inapplicable here so the CodeQL js/insufficient-password-hash finding (code-scanning alert 261) is correctly understood as a false positive. --- open-sse/executors/inner-ai.ts | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/open-sse/executors/inner-ai.ts b/open-sse/executors/inner-ai.ts index 09d5f0f3b1..2184ce96c9 100644 --- a/open-sse/executors/inner-ai.ts +++ b/open-sse/executors/inner-ai.ts @@ -61,6 +61,12 @@ function lruSet(map: Map, key: string, value: V): void { } } +// SHA-256 here derives an in-memory cache key from the session token — it is NOT +// password-at-rest storage. The slow KDFs CWE-916 recommends (bcrypt/scrypt/Argon2) +// are salted and non-deterministic, so they cannot be used as a stable Map key and +// would defeat the cache entirely. CodeQL js/insufficient-password-hash flags this as +// a false positive (dismissed); a fast cryptographic digest is the correct primitive +// for keying an ephemeral, process-local cache. function tokenCacheKey(token: string): string { return createHash("sha256").update(token).digest("hex"); }