v0.14 is out: a mobile auth pack for Swift/iOS and Android, catching insecure token storage, cleartext traffic, and OAuth in embedded WebViews. Read more →
MEDIUM AI PREVALENCE: MEDIUM auth.rust.crypto.bcrypt-low-cost

bcrypt::hash (or bcrypt::hash_with_result) is called with a cost factor below 10.

Why AI tools produce this: AI coding tools produce this regularly, typically when prompted for a shortcut or a quick fix.

Why this matters

A low work factor makes each hash cheap to compute, which lets an attacker brute-force stolen password hashes far too quickly. OWASP recommends a bcrypt cost of at least 10, and ≥ 12 for new applications, tuned so a single hash takes roughly 250ms on your hardware.

Common LLM-generated mistake: bcrypt::hash(password, 8) because the literal "looks fast enough". Use bcrypt::DEFAULT_COST (12) or raise the cost factor to 12 or higher.

VULNERABLE
vulnerable.rs
use bcrypt;

fn hash_cost_4(password: &str) -> String {
    // ruleid: auth.rust.crypto.bcrypt-low-cost
    bcrypt::hash(password, 4).unwrap()
}

fn hash_cost_8(password: &str) -> String {
    // ruleid: auth.rust.crypto.bcrypt-low-cost
    bcrypt::hash(password, 8).unwrap()
}

fn hash_cost_9_with_result(password: &str) -> String {
    // ruleid: auth.rust.crypto.bcrypt-low-cost
    let result = bcrypt::hash_with_result(password, 9).unwrap();
    result.to_string()
}
SAFE
safe.rs
use bcrypt;

fn hash_default_cost(password: &str) -> String {
    // ok: auth.rust.crypto.bcrypt-low-cost
    bcrypt::hash(password, bcrypt::DEFAULT_COST).unwrap()
}

fn hash_cost_12(password: &str) -> String {
    // ok: auth.rust.crypto.bcrypt-low-cost
    bcrypt::hash(password, 12).unwrap()
}

fn hash_cost_from_variable(password: &str, cost: u32) -> String {
    // ok: auth.rust.crypto.bcrypt-low-cost
    bcrypt::hash(password, cost).unwrap()
}

Suppressing this rule

If a finding is a genuine false positive, scope the suppression to the exact line and leave a reason, never disable the rule project-wide. Disable directives are line-scoped by design.

// oauthlint-disable-next-line auth.rust.crypto.bcrypt-low-cost -- <reason>

References

https://docs.rs/bcrypt/latest/bcrypt/fn.hash.html ↗https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html ↗https://cwe.mitre.org/data/definitions/916.html ↗