Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commit2a1a349

Browse files
wouterjweaverryan
authored andcommitted
Changed sha1 into bcrypt
1 parentd64258d commit2a1a349

File tree

2 files changed

+21
-21
lines changed

2 files changed

+21
-21
lines changed

‎book/security.rst

Lines changed: 16 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -1363,6 +1363,15 @@ any extra encoding. You can now calculate the hashed password either programmati
13631363
Supported algorithms for this method depend on your PHP version.
13641364
A full list is available calling the PHP function:phpfunction:`hash_algos`.
13651365

1366+
..caution::
1367+
1368+
The above example is not meaned for practical usage, it uses a weak hash
1369+
algorithm and it is only done to be able to generate the password easily. Using
1370+
:ref:`BCrypt<reference-security-bcrypt>` is a better option.
1371+
1372+
..versionadded::2.2
1373+
The BCrypt encoder was introduced in Symfony 2.2.
1374+
13661375
If you're creating your users dynamically (and storing them in a database),
13671376
you can use even tougher hashing algorithms and then rely on an actual password
13681377
encoder object to help you encode passwords. For example, suppose your User
@@ -1378,15 +1387,15 @@ configure the encoder for that user:
13781387
# ...
13791388
13801389
encoders:
1381-
Acme\UserBundle\Entity\User:sha512
1390+
Acme\UserBundle\Entity\User:bcrypt
13821391
13831392
..code-block::xml
13841393
13851394
<!-- app/config/security.xml-->
13861395
<config>
13871396
<!-- ...-->
13881397
1389-
<encoderclass="Acme\UserBundle\Entity\User"algorithm="sha512" />
1398+
<encoderclass="Acme\UserBundle\Entity\User"algorithm="bcrypt" />
13901399
</config>
13911400
13921401
..code-block::php
@@ -1395,20 +1404,17 @@ configure the encoder for that user:
13951404
$container->loadFromExtension('security', array(
13961405
// ...
13971406
'encoders' => array(
1398-
'Acme\UserBundle\Entity\User' => 'sha512',
1407+
'Acme\UserBundle\Entity\User' => 'bcrypt',
13991408
),
14001409
));
14011410
1402-
In this case, you're using the stronger ``sha512`` algorithm. Also, since
1403-
you've simply specified the algorithm (``sha512``) as a string, the system
1404-
will default to hashing your password 5000 times in a row and then encoding
1405-
it as base64. In other words, the password has been greatly obfuscated so
1406-
that the hashed password can't be decoded (i.e. you can't determine the password
1407-
from the hashed password).
1411+
In this case, you're using the strong ``bcrypt`` algorithm. This means that the
1412+
password has been greatly obfuscated so that the hashed password can't be
1413+
decoded (i.e. you can't determine the password from the hashed password).
14081414

14091415
..versionadded::2.2
14101416
As of Symfony 2.2 you can also use the:ref:`PBKDF2<reference-security-pbkdf2>`
1411-
and:ref:`BCrypt<reference-security-bcrypt>`passwordencoders.
1417+
passwordencoder.
14121418

14131419
Determining the Hashed Password
14141420
...............................

‎cookbook/security/entity_provider.rst

Lines changed: 5 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -257,9 +257,7 @@ then be checked against your User entity records in the database:
257257
security:
258258
encoders:
259259
Acme\UserBundle\Entity\User:
260-
algorithm: sha1
261-
encode_as_base64:false
262-
iterations: 1
260+
algorithm: bcrypt
263261
264262
role_hierarchy:
265263
ROLE_ADMIN: ROLE_USER
@@ -282,9 +280,7 @@ then be checked against your User entity records in the database:
282280
<!-- app/config/security.xml -->
283281
<config>
284282
<encoder class="Acme\UserBundle\Entity\User"
285-
algorithm="sha1"
286-
encode-as-base64="false"
287-
iterations="1"
283+
algorithm="bcrypt"
288284
/>
289285
290286
<role id="ROLE_ADMIN">ROLE_USER</role>
@@ -307,9 +303,7 @@ then be checked against your User entity records in the database:
307303
$container->loadFromExtension('security', array(
308304
'encoders' => array(
309305
'Acme\UserBundle\Entity\User' => array(
310-
'algorithm' =>'sha1',
311-
'encode_as_base64' => false,
312-
'iterations' => 1,
306+
'algorithm' =>'bcrypt',
313307
),
314308
),
315309
'role_hierarchy' => array(
@@ -335,9 +329,9 @@ then be checked against your User entity records in the database:
335329
),
336330
));
337331
338-
The``encoders`` section associates the``sha1`` password encoder to the entity
332+
The``encoders`` section associates the``bcrypt`` password encoder to the entity
339333
class. This means that Symfony will expect the password that's stored in
340-
the database to be encoded using thisalgorithm. For details on how to create
334+
the database to be encoded using thisencoder. For details on how to create
341335
a new User object with a properly encoded password, see the
342336
:ref:`book-security-encoding-user-password` section of the security chapter.
343337

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp