Skip to content

Re-add authenticable salt method #2260

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
jmhooper merged 2 commits into from
Jun 20, 2018
Merged

Re-add authenticable salt method #2260

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
653d2cd
Re-add authenticable salt method
jmhooper Jun 20, 2018
cde0ce9
Add a helpful comment
jmhooper Jun 20, 2018
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 7 additions & 0 deletions app/models/concerns/user_access_key_overrides.rb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,6 +23,13 @@ def password=(new_password)
write_legacy_password_attributes(digest)
end

def authenticatable_salt
return if encrypted_password_digest.blank?

@monfresh monfresh Jun 20, 2018

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I don't think we want to return here. There are probably some users who don't yet have an encrypted_password_digest, right? If those users sign in with RC 59, which uses password_salt as the authenticatable_salt, and then they hit RC 60, the salt will be different and their session will be dropped.

@jmhooper jmhooper Jun 20, 2018

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

There are not users who don't have an encrypted password digest. Those have been backfilled.

@jmhooper jmhooper Jun 20, 2018

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Rather, there should not be users who have an encrypted password but not an encrypted password digest.

Encryption::PasswordVerifier::PasswordDigest.parse_from_string(
encrypted_password_digest
).password_salt
end

@monfresh monfresh Jun 20, 2018

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Should we add a comment saying this is a Devise method required for authentication that we are overriding and that should not be removed as long as we need to override it?

@jmhooper jmhooper Jun 20, 2018

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Done

private

def write_legacy_password_attributes(digest)
Expand Down
9 changes: 9 additions & 0 deletions spec/models/user_spec.rb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -409,6 +409,15 @@
end
end

describe '#authenticatable_salt' do
it 'returns the password salt' do
user = create(:user)
salt = JSON.parse(user.encrypted_password_digest)['password_salt']

expect(user.authenticatable_salt).to eq(salt)
end
end

context 'when a password is updated' do
it 'writes encrypted_password_digest and the legacy password attributes' do
user = create(:user)
Expand Down