vic/comeonin_ecto_password

Ecto type for saving encrypted passwords using Comeonin

Comeonin Ecto Password

A custom Ecto type for storing encrypted passwords using Comeonin

For ecto 1 compatibility use the ecto-1 branch.

Version 3.x is compatible with comeonin ~> 5.0, use version 2.x for compatibility with older versions.

Usage

On your schema, define secure fields with this type:

field :password, Comeonin.Ecto.Password

Then on your changeset simply cast from plain-text params

changeset
|> cast(attrs, [:password])
|> validate_required([:password])

After casting the password will already be encrypted in the changeset, and can be saved to your table's string column.

To check for validity, do something like:

user = Repo.get_by(User, email: "[email protected]")
Comeonin.Ecto.Password.valid?("plain_password", user.password)

Configuration

In your environment file, choose one of Pbkdf2, Bcrypt, Argon2. The default is 'Pbkdf2, but you still need to include it in your mix.exs`!

config :comeonin, Ecto.Password, Pbkdf2

# when using pkbdf2
config :comeonin, :pbkdf2_rounds, 120_000
config :comeonin, :pbkdf2_salt_len, 512

# when using bcrypt
config :comeonin, :bcrypt_log_rounds, 14

Also, be sure to look at comeonin config

Installation

Available in Hex, the package can be installed as:

Add comeonin_ecto_password to your list of dependencies in mix.exs:

def deps do
  [{:comeonin_ecto_password, "~> 3.0.0"}]
end

comeonin_ecto_password's Issues

Password length validation

Hello,
as far as I understand, password is changed to hash as soon as it is casted, which causes trouble with validation. Currently the only way is to use Ecto.Changeset.change, validate length and then do everything else (casting etc.). I believe there should be config option in this library to set up minimal password length, to make changesets look more standard. Alternatively, if there is simpler solution I'm missing, I believe it should be added to README.