Skip to content

Replace bcrypt with SHA-512 password hashing #515

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
pkarman wants to merge 1 commit into from
Closed

Replace bcrypt with SHA-512 password hashing #515

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions Gemfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,6 +9,7 @@ gem 'american_date'
gem 'browserify-rails'
gem 'coffee-rails', '~> 4.1.0'
gem 'devise', '~> 4.1'
gem 'devise-encryptable'
gem 'dotiw'
gem 'figaro'
gem 'foundation_emails'
Expand Down
5 changes: 4 additions & 1 deletion Gemfile.lock
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -190,6 +190,8 @@ GEM
railties (>= 4.1.0, < 5.1)
responders
warden (~> 1.2.3)
devise-encryptable (0.2.0)
devise (>= 2.1.0)
diff-lcs (1.2.5)
docile (1.1.5)
dotenv (2.1.1)
Expand Down Expand Up @@ -618,6 +620,7 @@ DEPENDENCIES
database_cleaner
derailed
devise (~> 4.1)
devise-encryptable
dotiw
email_spec
factory_girl_rails
Expand Down Expand Up @@ -682,4 +685,4 @@ DEPENDENCIES
xmlenc (~> 0.6.4)

BUNDLED WITH
1.12.5
1.13.1
2 changes: 1 addition & 1 deletion app/models/user.rb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@ class User < ActiveRecord::Base

after_validation :set_default_role, if: :new_record?

devise :confirmable, :database_authenticatable, :recoverable, :registerable,
devise :confirmable, :database_authenticatable, :encryptable, :recoverable, :registerable,
:timeoutable, :trackable, :two_factor_authenticatable, :omniauthable,
omniauth_providers: [:saml]

Expand Down
2 changes: 1 addition & 1 deletion config/initializers/devise.rb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -204,7 +204,7 @@
# REST_AUTH_SITE_KEY to pepper).
#
# Require the `devise-encryptable` gem when using anything other than bcrypt
# config.encryptor = :sha512
config.encryptor = :sha512

# ==> Scopes configuration
# Turn scoped views on. Before rendering "sessions/new", it will first check for
Expand Down
5 changes: 5 additions & 0 deletions db/migrate/20160929142953_add_users_salt.rb
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,5 @@
class AddUsersSalt < ActiveRecord::Migration
def change
add_column :users, :password_salt, :string
end
end
3 changes: 2 additions & 1 deletion db/schema.rb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,7 +11,7 @@
#
# It's strongly recommended that you check this file into your version control system.

ActiveRecord::Schema.define(version: 20160915202036) do
ActiveRecord::Schema.define(version: 20160929142953) do

# These are extensions that must be enabled in order to support this database
enable_extension "plpgsql"
Expand Down Expand Up @@ -132,6 +132,7 @@
t.datetime "idv_attempted_at"
t.integer "idv_attempts", default: 0
t.string "recovery_code"
t.string "password_salt"
end

add_index "users", ["confirmation_token"], name: "index_users_on_confirmation_token", unique: true, using: :btree
Expand Down