hashing, best practices?

From: Robert Zeigler (robert.zeigle..mail.com)
Date: Thu Aug 07 2008 - 13:13:50 EDT

  • Next message: Michael Gentry: "Re: hashing, best practices?"

    Hi all,

    Up to this point, whenever I've had to store hashed text (say, the
    hashed from of a password) in the db, I've simply hashed in code.
    But the question arose the other day of how you would go about doing
    this on the database sided (assuming your target db supports your
    target hash function).
    Say, for example, you have the following table:

    users
        id integer
        username varchar('32')
        password varchar('40')

    And you want to hash the password as sha1.

    Using mysql and straight sql, you would do something like:

    insert into users (id,username,password)
    values(1,'userx',sha1('usery'));

    Is there some way to get cayenne to generate this same sql when
    inserting new rows?
    Or, for example, when cayenne detects a diff in password, and does an
    update users set password=..., to have it do
    password=sha1('newpassword')?

    Of course, I can hash the password in code... but it would be nice if
    cayenne could somehow manage this for me.

    And I could do some sort of ugly hack like having a post-persist
    callback that executes sqltemplate to sha1-hash the value of the newly
    inserted row... but that really is ugly.

    Surely I'm not the only one who hashes passwords in the database. ;)
    What are other people doing here? Does everyone just handle the
    hashing in code, like I've been doing up until now?

    Robert



    This archive was generated by hypermail 2.0.0 : Thu Aug 07 2008 - 13:14:26 EDT