Auth module for Kohana v3
Clone or download
Fetching latest commit…
Cannot retrieve the latest commit at this time.
Type Name Latest commit message Commit time
Failed to load latest commit information.
classes Cleanup coding stye violations. Feb 16, 2012
guide/auth Removing "lifetime" configuration and docs, it is not being used at a… Mar 18, 2012
.travis.yml Resolve composer downloading and caching issues on Travis Mar 21, 2016
composer.json Configure standalone travis build Sep 17, 2014

Kohana auth module

ver Stable Develop
3.3.x Build Status - 3.3/master Build Status - 3.3/develop
3.4.x Build Status - 3.4/master Build Status - 3.4/develop

I've forked the main Auth module because there were some fundamental flaws with it:

  1. It's trivial to bruteforce publicly hidden salt hashes.
    • I've fixed this by switching the password hashing algorithm to the more secure secret-key based hash_hmac method.
  2. ORM drivers were included.
    • I've fixed this by simply removing them. They cause confusion with new users because they think that Auth requires ORM. The only driver currently provided by default is the file driver.
  3. Auth::get_user()'s api is inconsistent because it returns different data types.
    • I've fixed this by returning an empty user model by default. You can override what gets returned (if you've changed your user model class name for instance) by overloading the get_user() method in your application.

These changes should be merged into the mainline branch eventually, but they completely break the API, so likely won't be done until 3.1.