TommyBlue.it » CakePHP http://www.tommyblue.it Bombardare per la pace è un po' come trombare per la verginità... Tue, 24 Jan 2012 09:34:19 +0000 en hourly 1 http://wordpress.org/?v=3.3.1 CakePHP authentication and password hashing http://www.tommyblue.it/2008/05/15/cakephp-authentication-and-password-hashing/ http://www.tommyblue.it/2008/05/15/cakephp-authentication-and-password-hashing/#comments Wed, 14 May 2008 23:50:15 +0000 TommyBlue http://www.tommyblue.it/?p=147 I had some problem with the authentication guide in the CakePHP book so i made some modifications to the wiki and i report here my problem.

If you create the user table as suggested in the guide you must know that the password used by CakePHP, before the standard hash SHA1 are encrypted with the seed saved in app/config/core.php in this way:
hashpwd = SHA1(seed+plain_text_password).

I didn’t know that and i saved my first user with:

INSERT INTO users (username, password) VALUES ('pippo', SHA1('pippo'));

And the login failed and failed…
So i spent a couple of hours trying to find an inexistent error in my code :(
At the end, after a full debug, i found it: the select query used a password hash different from mine, and the secret was revealed :D

]]> http://www.tommyblue.it/2008/05/15/cakephp-authentication-and-password-hashing/feed/ 0