yiisoft/security

A set of classes to handle common security-related tasks

security's Issues

PasswordHasher not compatible with php7.4

What steps will reproduce the problem?

$hash1 = (new PasswordHasher())->hash("qwerty");
$hash2 = (new PasswordHasher(PASSWORD_BCRYPT))->hash("qwerty");

What is the expected result?

hashed password

What do you get instead?

1st case: password_hash() expects parameter 3 to be array, null given
2nd case: A non well formed numeric value encountered

Additional info

in php 7.4
Password hashing algorithm identifiers are now nullable strings rather
than integers.

 * PASSWORD_DEFAULT was int 1; now is null
 * PASSWORD_BCRYPT was int 1; now is string '2y'
 * PASSWORD_ARGON2I was int 2; now is string 'argon2i'
 * PASSWORD_ARGON2ID was int 3; now is string 'argon2id'

Q	A
Version	1.0.?
PHP version	7.4.0beta2
Operating system	Ubuntu 18.04

update src folder links

What steps will reproduce the problem?

http=>https

What is the expected result?

What do you get instead?

Additional info

Q	A
Version	1.0.?
PHP version
Operating system

update irc link

What steps will reproduce the problem?

What is the expected result?

What do you get instead?

Additional info

Q	A
Version	1.0.?
PHP version
Operating system

Raise code coverage to 100%

PHP 7.2 Enh: Add Argon2 as password hashing algorithm

Argon2 for Secure Password Hashing

PHP 7.2 adds support for the Argon2 password hashing algorithm. Argon2 was the winner of the Password Hashing Competition and is being widely adopted as the modern standard for password hashing.

Hashing passwords with Argon2i is now as simple as:

password_hash('password_here', PASSWORD_ARGON2I);

Verifying passwords hashed with Argon2i is the same as before:

password_verify('password_here', $hash);

More about the changes to password_hash() here.

Review naming

Naming should be reviewed before first release. Please comment if you see a way to improve public API.