I use a different database and table for user authentication. Now I have current Hash as an example:
'$2a$08$UU.AJY.bcf0uJAp12WZvy.XE6CCgNAmuX8Hr17Pfkh3FRyFHWhBtO' = Test12345
But when I use Hash::check('Test12345', '$2a$08$UU.AJY.bcf0uJAp12WZvy.XE6CCgNAmuX8Hr17Pfkh3FRyFHWhBtO') it always returns false. So I think that's because the hashing uses a different method, so the prefix is $2a instead of $2y and 8 rounds instead of 12. I already tried to use $2y$12$UU.AJY.bcf0uJAp12WZvy.XE6CCgNAmuX8Hr17Pfkh3FRyFHWhBtO as my Hash to check, that doesn't work aswell and I just saw that on another stackoverflow post so I gave it a try.
Thanks in advance!
the same value can be hashed in different "codes"
to login use:
if (Auth::attempt(['email' => $request->email, 'password' => $request->password])) {
return "login sucess";
}
else{
return "fail";
}
Okay finally found it out. I first have to get the salt from the hash and hash the password once, then verify it and it works.
Related
I created user and I gave him password 'secret'.
The hash that was generated by the registration process is
$10$TKh8H1.PfQx37YgCzwiKb.KjNyWgaHb9cbcoQgdIVFlYg7B77UdFm
I wanted to generate it in the code so I used Hash::make('secret') and I got:
$2y$10$Hnbg7DCp2VObns4cbr580uo9VTYgzJF2BSNSpA7S8BYjkAgfUlH.G
finally I used bcrypt('secret') and I got:
$2y$10$5g1bhkHB7kRk8SkM3yS/YOifsEesjZ31YeYnRlE.bxSBmZutVCuui
These are all different hashes, How can I generate one that would let me change password inside my code?
It's because bcrypt doesn't work as SHA-256, it uses a key that would change the result of the hash itself for the same string.
In Laravel, you can use Hash::check('plain-text', $hashedPassword) to check the password, but you will never have the same result for the same password. check here
You can use bcrypt(secret") and leave it at laravel and test it (everything is working).
It works as intended, bcrypt doesnt always generate the same hash. Laravels Hash::check() function will return true for any valid hash of the given password.
For mor informations, look here: https://stackoverflow.com/a/8468936/6622577
Bycrypt is a more secure password hashing algorithm. Unlike md5() or SHA1() bycrypt does not always generate the same hashed value for a specific string.
So when you are storing the hashed password in the database you will use
$password = bcrypt($input['password']);
Afterwards, when you wish to check at the time of login you simply set the plain-text password (As you might be getting it from user input) and run a function called Auth::attempt() to match the password.
$userdata = array(
'username' => $input['username'],
'password' => $input['password'],
);
if (Auth::attempt($userdata)) {
// Password matched
}
And if you want to explicitly check the plain-text password corresponding to its hash then use Hash::check() as below:
Hash::check('plain-text-password', 'hashed-password);
I was using md5 to hash my passwords but learned that using bcrypt was more secure.
When using md5, it was easy to check whether a password entered in a form was correct. I simply done
if(md5($request->password) == $user->password)
//Login or whatever
So how do I do this using bcrypt? I tried
if(bcrypt($request->password) == $user->password)
But that isn't working.
Use the attempt() method:
if (Auth::attempt(['email' => $email, 'password' => $password]))
The attempt method accepts an array of key/value pairs as its first argument. The values in the array will be used to find the user in your database table.
https://laravel.com/docs/5.4/authentication#authenticating-users
Under the hood attempt() uses password_verify() method to check password.
You could also use the check method of the Hash Facade
if (Hash::check($request->password, $user->password)) {
// The passwords match...
}
https://laravel.com/docs/5.4/hashing#basic-usage
In my seeder I have hashed my code like this :
'validCode' => Hash::make('1110578abc')
it gives this result in the database : $2y$10$GaKhhxrMNCnzr
When I'm hashing the same code by input in my controller it gives a different value because of the random salt added by Bcrypt.
Controller :
dd(Hash::make(Input::get('code')));
(I typed in 1110578abc in this input field.)
It gives me this value :
$2y$10$xxVU78CphJEGOOTT1teNY.LeLb7kBjDvP9Npbf1h4.T4HDtuIFD16
For my application I would like to check if these 2 values match. Does annyone know how I can do this?
You can use Hash::check() method. The check method allows you to verify that a given plain-text string corresponds to a given hash.
Try:
if (Hash::check('plain-text', $hashedPassword)) {
// The passwords match...
}
You can read more about Laravel Hashing.
Specific code that answers to my post :
if (Hash::check(Input::get('code') , '$2y$10$GaKhhxrMNCnzr'))
{
dd('match');
}
else
{
dd('no match');
}
this solves it and returns 'match'.
I'm wondering how to use Hash::needsRehash() as I'm struggling to see using the documentation exactly what it's for.
if (Hash::needsRehash($hashed)) {
$hashed = Hash::make('plain-text');
}
What exactly causes Hash::needsRehash() to return true or false, does it return true if the hashed password is in another hash (such as MD5, SHA1 etc)?
In the case that your database is full of hashes in another algorithm and Hash::needsRehash() returns true, how would you rehash the users password so that it's they're up to date? You can't rely on the "login" password because it needs to be compared first to validate, right?
I guess maybe I'm overthinking things but I'm confused right now. Luckily my users passwords are using password_hash() anyway so shouldn't be a problem.
Hash::needsReHash() just calls php's built-in password_needs_rehash function. A helpful comment in the docs is:
// Check if a newer hashing algorithm is available
// or the cost has changed
if (password_needs_rehash($hash, PASSWORD_DEFAULT, $options)) {
So Hash::needsReHash() will return false if and only if hashing algorithm has changed (since you're not passing any options such as cost).
As for how and when to use this, you can only rehash a user's password when you have it -- e.g. when they're logging in. So during the login process, you check if their stored password's algorithm differs from your current algorithm, and if so, you replace their stored password hash with a new one.
This seems to be how to do it in Laravel 5.6
Put this in your LoginController:
protected function authenticated(Request $request, $user) {
if (Hash::needsRehash($user->password)) {
$user->password = Hash::make($request->password);
$user->save();
}
}
https://laravel.com/docs/5.6/hashing#basic-usage
The method returns true when PHP is updated and a new/better default algorithm was added or any other parameters changed. This lets you automatically take advantage of it without updating your code.
This method is used when a user is logging in as that is the only time you have access to the plain-text password. After confirming it is correct according to the old hash, you take the plain text password, rehash it, and put it back into the database for future use.
For a hypothetical example, lets say that right now the algorithm is md5() 10k times. In PHP7, it was updated to sha512() 15k times. If the hash is in the $count|$algo|$hash format, the method can tell when a hash is outdated. Since the old algorithm was not removed, you can still validate the password with old parameters before rehashing.
Note: obviously using md5()/sha512() is a bad idea. I'm just using them as examples.
I'm trying to implement authentication in laravel 4
When the user registers, I hash the password and save it, like this:
$password = Hash::make(Input::get('password'));
Then when the user tries to login, I want to authenticate him/her with the following code:
if (Auth::attempt(array('username' => Input::get('username'), 'password' => Hash::make(Input::get('password')))))
{
return Redirect::intended('dashboard');
}
and that never succeeds. I tried to debug the code and it seems that the Hash::make function always gives a different result.
Am I using a good authentication methods?
Don't Hash the password you are giving to the Auth::attempt method, it should be like this:
Auth::attempt(array('username' => Input::get('username'), 'password' => Input::get('password')));
You may also check the password using Hash::check('password', $hashedPassword). Read more about security on Laravel website.
Do not hash the password in the auth::attempt() function the code should be like this:
Auth::attempt(array('username' => Input::get('username'), 'password' => Input::get('password')));
The auth::attempt() will hash the password and then check if it matches the one stored in the database
To add some explanation to the answer, it is different every time because the hashing algorithm bcrypt generates a random string (salt) that has to be used to decrypt the password.
This is to protect passwords from rainbow table attacks. https://en.wikipedia.org/wiki/Rainbow_table