Using username as property to salt passwords does not work out anymore

synyx / minos

Minos is a thin framework layer built on Spring, that helps you to develop applications in a modular way.

Apache License 2.0

2 stars 0 forks source link

Closed fabianbuch closed 12 years ago

fabianbuch commented 12 years ago

As we have relieved the @User@ from being immutable, salting the password with it does not work out anymore. Suppose the following scenario:

A user is created and her password is being encrypted
The user changes its username
Authentication does not work anymore as the equality check uses a different salt than at encryption time

fabianbuch commented 12 years ago

Comment of Oliver Gierke: Applied in changeset r8047.