No password_hash function to encrypt password in request

PeeHaa / OpCacheGUI

GUI for PHP's OpCache

1.46k stars 170 forks source link

No password_hash function to encrypt password in request #79

Closed ushell closed 7 years ago

ushell commented 7 years ago

1.load configure password in index.php 2.get password in routes.php (no encrypt) 3.login function in Auth\User.php use hash_verify() to compare user raw input, but this password is not encrypt! How to use password_verify to compare different strings?

PeeHaa commented 7 years ago

Generate the password hash locally using password_hash('yourpassword', PASSWORD_DEFAULT, ['cost' => 14]);.

Or use my site if you really have to. Note that the information submitted (the password) is being send to my server.