I have what I think is a securely generated salt/hashing mechanism for HMAC authentication based on SHA256 in place. However, I'm using the salt in, from what I can see, a fairly standard way of just appending to the rest of the token before the hash generation like so;
// conceptual, not actual code... var saltedToken = token + salt; var hash = HashGenerator.Get(saltedToken);
But is appending the salt enough to be secure or should I be doing something more with it, e.g. applying the salt as an XOR operation on the rest of the token, etc. This answer implies that putting the salt at the start may be insecure in some hashing algorithms but I'm left unsure.
Is a straight forward "append salt" approach enough? Or do I need to scramble it further before hashing?