[gzer0]

Here's how I see it:

Core issue (okta's approach):

  * They concatenated userId + username + password for a cache key
  * Used BCrypt (which has a 72-byte limit)
  * The concatenation could exceed 72 bytes, causing the password portion to be truncated

Why this is problematic:

  * BCrypt is designed for password hashing, not cache key generation
  * Mixing identifiers (userId, username) with secrets (password) in the same hash
  * Truncation risk due to BCrypt's limits

Password storage should be separate from cache key generation. Use a random salt + appropriate hash function and for cache keys - use HMAC or KDF w/appropriate inputs