security - 将 Cakephp2 身份验证迁移到 Cakephp 3

Question

我正在将一个应用程序从 CakePHP 2 迁移到 CakePHP 3。Cake3 有一个新的哈希算法。我希望现有用户能够使用旧密码登录应用程序，然后将这些密码更新为新算法。

不幸的是，我无法获得与数据库中的内容相匹配的正确哈希值。

$person = $this->Auth->identify();
if(!$person){ # maybe they have old sha1 password?
  $oldhash = Security::hash($this->request->data['password'], 
                           'sha1', "oldsalt");                  
  $person = $this->People->find()->where(['password' => $oldhash])->where(['email' =>$this->request->data['email'] ])->first();
  if($person){
    $person->password = Security::hash($this->request->data['password']);
    $this->People->save($person);
  }             
}

找不到用户，如果我调试 $oldhash ，我会得到一个与该用户的密码字段中存储的字符串不同的字符串。

我做错了什么？

Answer 1

后备类

根据documentation :

CakePHP provides a clean way to migrate your users’ passwords from one algorithm to another, this is achieved through the FallbackPasswordHasher class. Assuming you are migrating your app from CakePHP 2.x which uses sha1 password hashes, you can configure the AuthComponent as follows:

您必须创建一个 Custom Password Hasher类src/Auth/。自定义密码哈希器看起来像这样:

namespace App\Auth;

use Cake\Auth\AbstractPasswordHasher;

class LegacyPasswordHasher extends AbstractPasswordHasher {

    public function hash($password)
    {
        return sha1($password);
    }

    public function check($password, $hashedPassword)
    {
        return sha1($password) === $hashedPassword;
    } }

然后将其添加到authenticate中的passwordhasher作为fallback，如下所示:

'authenticate' => [
                'Form' => [
                    'passwordHasher' => [
                        'className' => 'Fallback',
                        'hashers' => [
                            'Default',
                            'Legacy'
                        ]
                    ]
                ]
            ]

The first name appearing in the hashers key indicates which of the classes is the preferred one, but it will fallback to the others in the list if the check was unsuccessful.

旧版是 Custom Password Hasher .

更新密码

要将用户的密码更新为新的哈希值，您只需将此代码添加到您的登录过程中即可:

if ($this->Auth->authenticationProvider()->needsPasswordRehash()) {
    $user = $this->Users->get($this->Auth->user('id'));
    $user->password = $this->request->data('password');
    $this->Users->save($user);
}

文档

• More information about Changing hashing Algorithms
• More information about the Custom Password Hasher