UserAuthenticationService
class UserAuthenticationService (View source)
Class UserAuthenticationService
Provides various methods for managing password hashing and verification.
Constants
| private BCRYPT_MIN_COST |
|
| private BCRYPT_MAX_COST |
|
| private DUMMY_HASH_BODY |
|
Methods
No description
A well-formed bcrypt hash that no submitted password is expected to match, at the configured cost.
Generate a random salt string.
Hash a password using the specified method.
Verify if a password matches the hashed password.
Check if the hashed password requires rehashing.
Identify the hash algorithm used for the given hash.
Generate a combined salt for the given password.
Combine a salt with a password.
Extract the user salt from the given password.
Details
__construct(string $passwordEncryption = 'bcrypt', int $passwordEncryptionCost = 12)
No description
string
dummyVerificationHash()
A well-formed bcrypt hash that no submitted password is expected to match, at the configured cost.
Callers use it to spend the same time on a login for a user that does not exist as on one that does. Only the cost digits are substituted - the salt and digest stay valid, so password_verify() runs the full key derivation before returning false, and no hash has to be computed per request.
Always bcrypt: an argon2i/argon2id install still gets most of the delay, which is the point, without needing a constant per parameter set.
string
generateSalt(int $len = 5)
Generate a random salt string.
Draws from random_int(): the installer builds the session encryption key with this, and mt_rand() would cap that key at its 32-bit seed.
string
hashPassword(string $password)
Hash a password using the specified method.
bool
verifyPassword(string $password, string $hash)
Verify if a password matches the hashed password.
bool
requiresRehash(string $hash)
Check if the hashed password requires rehashing.
string
identifyHashAlgorithm(string $hash)
Identify the hash algorithm used for the given hash.
string
generateCombinedSalt(string $pass)
Generate a combined salt for the given password.
string
combineSalts(string $salt, string $pass)
Combine a salt with a password.
string
extractUserSalt(string $password)
Extract the user salt from the given password.