[BREAKING CHANGE] Improve security

1 files changed, 14 insertions, 1 deletions

diff --git a/src/api/endpoints/auth/accept.js b/src/api/endpoints/auth/accept.js
index 7c45650c6b..9eb5d2e7e2 100644
--- a/src/api/endpoints/auth/accept.js
+++ b/src/api/endpoints/auth/accept.js
@@ -4,6 +4,8 @@
  * Module dependencies
  */
 import rndstr from 'rndstr';
+const crypto = require('crypto');
+import App from '../../models/app';
 import AuthSess from '../../models/auth-session';
 import Userkey from '../../models/userkey';
 
@@ -41,12 +43,23 @@ module.exports = (params, user) =>
 	});
 
 	if (exist === null) {
+		// Lookup app
+		const app = await App.findOne({
+			app_id: session.app_id
+		});
+
+		// Generate Hash
+		const sha512 = crypto.createHash('sha512');
+		sha512.update(key + app.secret);
+		const hash = sha512.digest('hex');
+
 		// Insert userkey doc
 		await Userkey.insert({
 			created_at: new Date(),
 			app_id: session.app_id,
 			user_id: user._id,
-			key: key
+			key: key,
+			hash: hash
 		});
 	}