我正在尝试使用Sinatra和BCrypt实现看似非常简单的身份验证方法,但很明显我错过了一些东西......
用户预先分配了一个临时密码,该密码以明文形式存储在数据库中.
我对临时密码进行身份验证,然后创建一个salt和password_hash并将它们作为字符串写入db(在本例中为mongo).
要进行身份验证,我从db和用户密码中获取salt以进行比较.
post "/password_reset" do
user = User.first(:email => params[:email], :temp_password => params[:temp_password])
if dealer != nil then
password_salt = BCrypt::Engine.generate_salt
password_hash = BCrypt::Engine.hash_secret(params[:password], password_salt)
user.set(:password_hash => password_hash)
user.set(:password_salt => password_salt)
end
end
post "/auth" do
@user = User.first(:email => params[:email])
@user_hash = BCrypt::Password.new(@user.password_hash) #because the password_hash is stored in the db as a string, I cast it as a BCrypt::Password for comparison
if @user_hash == BCrypt::Engine.hash_secret(params[:password], @user.password_salt.to_s) then
auth = true
else
auth = false
end
end …