Password saving method (Security issue)
i3130002 opened this issue · comments
Years ago I used this project to address a website login background but now that I know more about security I get that we must passwords as a Hash of (password+salt) PLUS saving the salt in another column in order to be able to verify user.
If I am right about your code bellow(./classes/login.php) :
In line 84 it checks the direct hash of the password with the saved one. Also in the database we have no salt column.
May I ask to put some time to fix it or please put an alert at the beginning of the readme so people don't use it as a prefect example or in real world ?
My bad! As of further looking into the saved password I noticed that it combines them all together.
for more reference one can visit https://stackoverflow.com/questions/6832445/how-can-bcrypt-have-built-in-salts
;)