Potential fix for code scanning alert no. 513: Use of a broken or weak cryptographic hashing algorithm on sensitive data

[ZePan110]

Potential fix for https://github.com/opea-project/GenAIExamples/security/code-scanning/513

In general, to fix this type of issue you should not use a fast, general‑purpose hash (like SHA‑256) directly on secrets that function as passwords or authentication tokens. Instead, use a password hashing/KDF algorithm that is intentionally slow and parameterizable (e.g., Argon2, bcrypt, PBKDF2). This makes brute‑force attacks on stolen hashes significantly harder.

In this file, the simplest, least‑disruptive fix is to reuse the existing passlib CryptContext instance (pwd_context) already configured with bcrypt for passwords. That ensures API keys and passwords both use a computationally expensive, salted hash, and we don’t introduce new external dependencies or concepts. Concretely:

• Change hash_api_key to call pwd_context.hash(api_key) instead of hashlib.sha256(...).
• Change verify_api_key to call pwd_context.verify(api_key, hashed_key) instead of recomputing SHA‑256 and comparing.
• Leave the rest of the code and public interface unchanged: both functions still take/return strings, so callers won’t need to change how they store or compare API keys.

pwd_context and its imports already exist at the top of security.py, so no new imports or helper functions are required. The changes are confined to lines 115–122 in CogniwareIms/backend/app/core/security.py.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues found.

Scanned Files

None

[Copilot]

Pull request overview

This PR addresses a security vulnerability (code scanning alert #513) by replacing weak SHA-256 hashing with bcrypt for API key storage. The change migrates from a fast, general-purpose hash to a slow, cryptographically secure password hashing algorithm, making brute-force attacks on stolen API keys significantly harder.

Changes:

• Replaced hashlib.sha256 with pwd_context.hash (bcrypt) in hash_api_key method
• Replaced SHA-256 comparison with pwd_context.verify in verify_api_key method

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.