Support for hashed passwords?

[miguelgrinberg]

Support for hashed passwords?

[miguelgrinberg]

The definition of what "password" means is up to the implementer, it does not necessarily need to be the unencrypted password selected by the user. You could return a hashed password from the get_password callback, and as long as the client applies the same hash function before submitting the password with the request things will work the same. Would that work?

[cliffmcc]

I considered that. It could work, but it requires that matching hashes be calculated on the client in JS. By definition there should be nothing "secret" about the hashing algorithm, so this doesn't lower security itself, but it does mean you need hashing code in JS. However, it does lower the security-through-obscurity factor a bit, since this would make any user-specific salt publicly visible.

Overall, it would still be better to do all the hashing on the server side and send the plain password over SSL.

Not a real problem for me personally, just an observation I had while reading about this extension in your recent blog post. Nice post by the way.

[miguelgrinberg]

I think I now understand what you are saying. What I'm missing is a callback that can optionally transform the password submitted by the client before it gets compared against the one returned by get_password. If I had that then the client sends the plain password, but the server applies the hashing function that matches what was applied prior to storing the password in the database.

Not a bad idea.

[cliffmcc]

That's exactly what I was thinking. This would let the server provide arbitrary hashing algorithms. Thanks for considering it.

[miguelgrinberg]

I've added a hash_password callback (only for basic auth).

[lunayo]

Is it possible to get both username and password information in hash_password callback? I need username to retrieve password's salt in database before creating a hash_password for comparing. The hash_password format is probably similar to this sha(password+salt)

[miguelgrinberg]

@lunayo Makes perfect sense. I'll look into that.

[miguelgrinberg]

@lunayo: just pushed version 2.1.0 with this change. The hash password callback can now also take two arguments, username and password in that order.