I created user and I gave him password 'secret'.
The hash that was generated by the registration process is
$10$TKh8H1.PfQx37YgCzwiKb.KjNyWgaHb9cbcoQgdIVFlYg7B77UdFm
I wanted to generate it in the code so I used Hash::make('secret') and I got:
$2y$10$Hnbg7DCp2VObns4cbr580uo9VTYgzJF2BSNSpA7S8BYjkAgfUlH.G
finally I used bcrypt('secret') and I got:
$2y$10$5g1bhkHB7kRk8SkM3yS/YOifsEesjZ31YeYnRlE.bxSBmZutVCuui
These are all different hashes, How can I generate one that would let me change password inside my code?
It's because bcrypt doesn't work as SHA-256, it uses a key that would change the result of the hash itself for the same string.
In Laravel, you can use Hash::check('plain-text', $hashedPassword) to check the password, but you will never have the same result for the same password. check here
You can use bcrypt(secret") and leave it at laravel and test it (everything is working).
It works as intended, bcrypt doesnt always generate the same hash. Laravels Hash::check() function will return true for any valid hash of the given password.
For mor informations, look here: https://stackoverflow.com/a/8468936/6622577
Bycrypt is a more secure password hashing algorithm. Unlike md5() or SHA1() bycrypt does not always generate the same hashed value for a specific string.
So when you are storing the hashed password in the database you will use
$password = bcrypt($input['password']);
Afterwards, when you wish to check at the time of login you simply set the plain-text password (As you might be getting it from user input) and run a function called Auth::attempt() to match the password.
$userdata = array(
'username' => $input['username'],
'password' => $input['password'],
);
if (Auth::attempt($userdata)) {
// Password matched
}
And if you want to explicitly check the plain-text password corresponding to its hash then use Hash::check() as below:
Hash::check('plain-text-password', 'hashed-password);
Related
I was using md5 to hash my passwords but learned that using bcrypt was more secure.
When using md5, it was easy to check whether a password entered in a form was correct. I simply done
if(md5($request->password) == $user->password)
//Login or whatever
So how do I do this using bcrypt? I tried
if(bcrypt($request->password) == $user->password)
But that isn't working.
Use the attempt() method:
if (Auth::attempt(['email' => $email, 'password' => $password]))
The attempt method accepts an array of key/value pairs as its first argument. The values in the array will be used to find the user in your database table.
https://laravel.com/docs/5.4/authentication#authenticating-users
Under the hood attempt() uses password_verify() method to check password.
You could also use the check method of the Hash Facade
if (Hash::check($request->password, $user->password)) {
// The passwords match...
}
https://laravel.com/docs/5.4/hashing#basic-usage
I'm wondering how to use Hash::needsRehash() as I'm struggling to see using the documentation exactly what it's for.
if (Hash::needsRehash($hashed)) {
$hashed = Hash::make('plain-text');
}
What exactly causes Hash::needsRehash() to return true or false, does it return true if the hashed password is in another hash (such as MD5, SHA1 etc)?
In the case that your database is full of hashes in another algorithm and Hash::needsRehash() returns true, how would you rehash the users password so that it's they're up to date? You can't rely on the "login" password because it needs to be compared first to validate, right?
I guess maybe I'm overthinking things but I'm confused right now. Luckily my users passwords are using password_hash() anyway so shouldn't be a problem.
Hash::needsReHash() just calls php's built-in password_needs_rehash function. A helpful comment in the docs is:
// Check if a newer hashing algorithm is available
// or the cost has changed
if (password_needs_rehash($hash, PASSWORD_DEFAULT, $options)) {
So Hash::needsReHash() will return false if and only if hashing algorithm has changed (since you're not passing any options such as cost).
As for how and when to use this, you can only rehash a user's password when you have it -- e.g. when they're logging in. So during the login process, you check if their stored password's algorithm differs from your current algorithm, and if so, you replace their stored password hash with a new one.
This seems to be how to do it in Laravel 5.6
Put this in your LoginController:
protected function authenticated(Request $request, $user) {
if (Hash::needsRehash($user->password)) {
$user->password = Hash::make($request->password);
$user->save();
}
}
https://laravel.com/docs/5.6/hashing#basic-usage
The method returns true when PHP is updated and a new/better default algorithm was added or any other parameters changed. This lets you automatically take advantage of it without updating your code.
This method is used when a user is logging in as that is the only time you have access to the plain-text password. After confirming it is correct according to the old hash, you take the plain text password, rehash it, and put it back into the database for future use.
For a hypothetical example, lets say that right now the algorithm is md5() 10k times. In PHP7, it was updated to sha512() 15k times. If the hash is in the $count|$algo|$hash format, the method can tell when a hash is outdated. Since the old algorithm was not removed, you can still validate the password with old parameters before rehashing.
Note: obviously using md5()/sha512() is a bad idea. I'm just using them as examples.
I'm trying to implement authentication in laravel 4
When the user registers, I hash the password and save it, like this:
$password = Hash::make(Input::get('password'));
Then when the user tries to login, I want to authenticate him/her with the following code:
if (Auth::attempt(array('username' => Input::get('username'), 'password' => Hash::make(Input::get('password')))))
{
return Redirect::intended('dashboard');
}
and that never succeeds. I tried to debug the code and it seems that the Hash::make function always gives a different result.
Am I using a good authentication methods?
Don't Hash the password you are giving to the Auth::attempt method, it should be like this:
Auth::attempt(array('username' => Input::get('username'), 'password' => Input::get('password')));
You may also check the password using Hash::check('password', $hashedPassword). Read more about security on Laravel website.
Do not hash the password in the auth::attempt() function the code should be like this:
Auth::attempt(array('username' => Input::get('username'), 'password' => Input::get('password')));
The auth::attempt() will hash the password and then check if it matches the one stored in the database
To add some explanation to the answer, it is different every time because the hashing algorithm bcrypt generates a random string (salt) that has to be used to decrypt the password.
This is to protect passwords from rainbow table attacks. https://en.wikipedia.org/wiki/Rainbow_table
I am trying to use my stored passwords from Laravel 4 in a fresh Phalcon Installation. I have no idea whether this is possible and tried it this way in the SessionController of the Phalcon sample-apllication INVO:
#$password = sha1($password);
$password = password_hash($password, PASSWORD_BCRYPT);
Can I use another Hash-Algorythm in phalcon, that fits to Laravel 4 Passwords, or can I convert the hashes somehow?
You should be able to use laravel hashses - all you need to do is to check how Laravel is creating and checking them.
Check this code from BCryptHasher::make() and this for validating.
The problem is that in Laravel this algorithm is a bit different. First is obtaining user from database then checking if password is the same with password_verify. While in INVO you first hash the given password and then you search for a user with given email and hash - if it finds anything then it can log user. Below should do the trick knowing the $cost value from Laravel settings (class defaults to 10).
$password = password_hash($value, PASSWORD_BCRYPT, array('cost' => $cost));
Edit: while above would be true for SHA1 & similar. The INVO code should be changed to match the login algorithm in Laravel and BCrypt itself:
$user = Users::findFirst(array("email = :email: AND active='Y'", 'bind' => array('email' => $email));
if ($user != false && password_verify($user->password, $this->request->getPost('password'))) {
// login user
}
Laravel is using BCrypt for a reason - it is generally very good choice for hashing so you should stick to it.
Anyway you could write a password migration which will do upon each user successful login:
validate user password using old hashing algorithm
checks if User has migrated it's password (ie by checking some database field - or separated table)
hash given password with new algorithm
store new hash and update user table (with information that hash has been changed)
Which is rather complicated and should be needed only when migrating to "better" algorithm.
My problem is that I can still log in even I typed in the wrong password. I can't seem to know if there's a problem on how I decoded the password.
encryption key:
$config['encryption_key'] = 'formcreatormj';
Log in code:
function login($email,$password){
$pw = $this->encrypt->decode($password);
$this->db->where('email',$email);
$this->db->where('password', $pw);
$query=$this->db->get('user');
if($query->num_rows()>0){
foreach($query->result() as $rows){
//add all data to session
$this->addSession($rows->id, $rows->username);
}
return true;
}
return false;
}
You should not be using the Encryption class for working with passwords. Passwords should be hashed one-way, to prevent the original plaintext from being recovered trivially. Codeigniter's Encryption class provides two-way encryption and is unsuitable for passwords.
Instead, you should be working with bcrypt - How do you use bcrypt for hashing passwords in PHP?
You are going about the hashing wrong. Typically you'd store the hash of the password in the database. i.e. when the user signs up, you $this->encrypt->encode() the password and store that in the database.
Next time the user tries to log in, you again hash the password they enter in the login and compare that to the hashed password in the database.
But, since, by default, codeigniter uses mcrypt, these hashes won't match. So what you need to do is pull the hash from the db, decrypt that and compare that with the submitted password.
$this->db->where('email',$email);
$query = $this->db->get('user')->row(0);
if($this->encrypt->decode($query->password) == $password){
//password OK
}else{
//password not OK
}
What you are doing is trying to decrypt the submitted password which isn't encrypted.
Edit: strongly agree with #xiankai You really should be using bcrypt for passwords.