Upgrade password hashes on authentication#152
Upgrade password hashes on authentication#152KlausTrainer wants to merge 2 commits intoapache:masterfrom
Conversation
src/couchdb/couch_httpd_auth.erl
Outdated
There was a problem hiding this comment.
We should upgrade their hash after they've authenticated and proved they got the password right. Won't this just save whatever password they tried and make it the users actual password?
There was a problem hiding this comment.
Yeah, you're totally right. My intention was to implement it exactly the way you suggest, and I have no idea why I didn't ;)
There was a problem hiding this comment.
Just realized that there should also be a test case that checks that no upgrade is being done when the password is wrong. I'll add that later.
There was a problem hiding this comment.
Btw., I also realized that the way I did the password hash upgrade here would totally introduce a security hole that would random people allow to choose an arbitrary new password if the existing password would be hashed with the old password scheme.
There was a problem hiding this comment.
yes, that's what I was saying in my comment. :)
|
Updated it according to the results of my previous discussion with @rnewson. |
This removes client-side password crypto from the JavaScript tests. In some JavaScript tests, it has been assumed that SHA-1 is used for the password hash in user docs. Those tests should, however, not rely on implementation details of the user authentication hash function, as it isn't the goal of those tests to check these. Furthermore, this causes problems when a password scheme is changed, or a new one is introduced.
We now upgrade user docs to the new PBKDF2 password scheme on successful authentication if the password hash is still from the old days where we only used plain SHA-1 for hashing salted passwords. Closes COUCHDB-1780.
|
+1, looks good to me. Thanks! |
|
Klaus Trainer on dev@couchdb.apache.org replies: |
This closes apache#152 Signed-off-by: ILYA Khlopotov <iilyak@ca.ibm.com>
Fix erl_opts use
3 participants
We now upgrade user docs to the new PBKDF2 password scheme on successful
authentication if the password hash is still from the old days where we
only used plain SHA-1 for hashing salted passwords.
Closes COUCHDB-1780.