preaction / Yancy

The Best Web Framework Deserves the Best Content Management System
http://preaction.me/yancy/
Other
54 stars 21 forks source link

Problem with Yancy::Plugin::Auth::Password + Mojo::mysql #80

Closed pavelsr closed 4 years ago

pavelsr commented 4 years ago

Made a demo repository https://github.com/pavelsr/yancy_passw_auth_problem, please see

preaction commented 4 years ago

Looks like the issue is that the Perl Digest module removes all the trailing padding from the base-64 representation. So, if the resulting string is not a multiple of 4 characters long, it won't match other base-64 encoded strings:

$ mysql -e'SELECT TO_BASE64(UNHEX(SHA1("admin")))'
+---------------------------------+
| TO_BASE64(UNHEX(SHA1("admin"))) |
+---------------------------------+
| 0DPiKuNIrrVmD8IUCuw1hQxNqZc=    |
+---------------------------------+
$ perl -MDigest -E'say Digest->new( "SHA-1" )->add( "admin" )->b64digest'
0DPiKuNIrrVmD8IUCuw1hQxNqZc

So, I should definitely document this issue, but the fix for you is probably to change your MySQL slightly to add something like TRIM( TRAILING "=" FROM ... ) or REPLACE( ..., "=", "" ).

$ mysql -e'SELECT TRIM( TRAILING "=" FROM TO_BASE64(UNHEX(SHA1("admin"))))'
+----------------------------------------------------------+
| TRIM( TRAILING "=" FROM TO_BASE64(UNHEX(SHA1("admin")))) |
+----------------------------------------------------------+
| 0DPiKuNIrrVmD8IUCuw1hQxNqZc                              |
+----------------------------------------------------------+
$ mysql -e'SELECT REPLACE(TO_BASE64(UNHEX(SHA1("admin"))), "=", "")'
+---------------------------------------------------+
| REPLACE(TO_BASE64(UNHEX(SHA1("admin"))), "=", "") |
+---------------------------------------------------+
| 0DPiKuNIrrVmD8IUCuw1hQxNqZc                       |
+---------------------------------------------------+

So, I'll add some documentation along with sample code to create users directly in the database. Thanks for the report!