Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

A more secure and generalized approach for PDO Basic Auth Backend #1283

Closed
wants to merge 1 commit into from
Closed

A more secure and generalized approach for PDO Basic Auth Backend #1283

wants to merge 1 commit into from

Conversation

lightbluetom
Copy link
Contributor

Hello,

motivated by the currently insecure password hashing in sabre/dav (as discussed in Baikal #514), I developed this PR. It allows administrators to choose any password hashing function supported by password_verify() (among others, this includes the state of the art hashes bcrypt and Argon).

Furthermore this PR is about generalized approach on using the PDO Backend with Basic Authentication. The supplied Backend allows the customization of:

  • tableName : table in which the user information is stored,
  • digestColumn : table column in which the digest/passoword hash is stored,
  • digestPrefix : if your user management Backend prefixes your digests, you can specify it so it will be removed before verfiying it.

I think this covers a large part of use cases and would benefit a lot of sabre/dav users.

Best Regards.

@lightbluetom lightbluetom marked this pull request as draft July 15, 2020 15:45
@lightbluetom lightbluetom marked this pull request as ready for review July 15, 2020 16:00
@lightbluetom
Copy link
Contributor Author

Closing this Request, because i have some problems pushing to this PR.

Sorry for the inconvinience.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant