Verifying with a pre-parsed JSON object

[ericelliott]

Verifying with a pre-parsed JSON object

[tjconcept]

Whatever is returned from hash is supposed to go unmodified into verify again.

The fact that hash returns a JSON string is an implementation detail, is not documented, and could change without triggering a new major release. That's why you should not parse it and not store it as anything else than an opaque value.

If you really want to, you should parse it on one side (after hash) and stringify it on the other (before verify).

[matt-oakes]

Ah OK. That makes sense. From the description of hash it says explicitly that it returns a JSON object, so I thought it would be stable. I'll change my database schema to simply accept a string.

Thanks for the quick reply!

[tjconcept]

You're right, and I might be over-idealistic about it but unless you have some really good reason to, I'd not run the risk.

I'll close this for now, but feel free to follow up, I'll answer or reopen if necessary :)

[matt-oakes]

No problem at all, I can see the reasoning for it, and I'll hever used the password hash JSON directly, so it makes no difference to me.

It might be worth making this recommendation in the readme though, just in case.