Skip to content

Conversation

PrajwalM2212
Copy link
Contributor

What does this PR do?

Hashes the password on server side instead of client side

Fixes #put issue number here.
#969

@PrajwalM2212
Copy link
Contributor Author

PrajwalM2212 commented Feb 20, 2021

Changes done

  1. Password is not hashed at frontend during registration or login
  2. The Auth resource uses sha3_512 to generate the hash from the password and compares it with the already stored hash
  3. For registration, password is hashed at monkey/monkey_island/cc/environment/user_creds.py while creating user creds

I have not tested these changes yet due to some problems ( Will ask the slack channel for help ). I have read the relevant code and made appropriate changes.

@mssalvatore Should we use https://flask-bcrypt.readthedocs.io/en/latest/ for salting ?

@mssalvatore
Copy link
Collaborator

I'm good with using bcrypt instead of sha3_512.

@acepace
Copy link
Contributor

acepace commented Mar 31, 2021

sha3_512

This requires updating the relevant docs to explain how to debug this?

@shreyamalviya
Copy link
Contributor

Continued in #1139

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants