{"action":"created","issue":{"url":"https://api.github.com/repos/mohiva/play-silhouette/issues/461","repository_url":"https://api.github.com/repos/mohiva/play-silhouette","labels_url":"https://api.github.com/repos/mohiva/play-silhouette/issues/461/labels{/name}","comments_url":"https://api.github.com/repos/mohiva/play-silhouette/issues/461/comments","events_url":"https://api.github.com/repos/mohiva/play-silhouette/issues/461/events","html_url":"https://github.com/mohiva/play-silhouette/pull/461","id":146389502,"number":461,"title":"Define meaningful interface for password re-hashing","user":{"login":"akkie","id":307006,"avatar_url":"https://avatars.githubusercontent.com/u/307006?v=3","gravatar_id":"","url":"https://api.github.com/users/akkie","html_url":"https://github.com/akkie","followers_url":"https://api.github.com/users/akkie/followers","following_url":"https://api.github.com/users/akkie/following{/other_user}","gists_url":"https://api.github.com/users/akkie/gists{/gist_id}","starred_url":"https://api.github.com/users/akkie/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/akkie/subscriptions","organizations_url":"https://api.github.com/users/akkie/orgs","repos_url":"https://api.github.com/users/akkie/repos","events_url":"https://api.github.com/users/akkie/events{/privacy}","received_events_url":"https://api.github.com/users/akkie/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":13,"created_at":"2016-04-06T18:02:00Z","updated_at":"2016-04-20T15:53:28Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/mohiva/play-silhouette/pulls/461","html_url":"https://github.com/mohiva/play-silhouette/pull/461","diff_url":"https://github.com/mohiva/play-silhouette/pull/461.diff","patch_url":"https://github.com/mohiva/play-silhouette/pull/461.patch"},"body":"WIP\r\n\r\nIn contrast to the current implementation it now defines the clear responsibility for every component. Currently this is defined squishy in the interface and therefore can lead to bugs like #454 or #459.\r\n\r\nWhat are the changes for the user:\r\nIt's now unambiguous when a password hasher or a password is deprecated and when it should be updated with a newer algorithm. This is now defined through the `PasswordHasherRegistry`. It accepts two parameters. The current preferred algorithm and the list of deprecated hashers which are needed to macht the old hashes which are stored in the database.\r\n\r\nSo to instantiate the `CredentialsProvider` as example, a user must now write:\r\n```scala\r\nnew CredentialsProvider(..., new PasswordHasherRegistry(new BCryptPassordHasher(10)))\r\n```\r\n\r\ninstead of\r\n\r\n```scala\r\nnew CredentialsProvider(..., new BCryptPassordHasher(10), Seq(new BCryptPassordHasher(10)))\r\n```\r\n\r\nI can now handle the case of a deprecated password for a not deprecated password hasher as described in #454.\r\n\r\nThe user can only increase the log rounds for a password hasher:\r\n```scala\r\nnew CredentialsProvider(..., new PasswordHasherRegistry(new BCryptPassordHasher(20)))\r\n```\r\n\r\nIf another password hashing algorihtm should be used, then it's now clear defined what hasher is preferred and which is deprecated.\r\n```scala\r\nnew CredentialsProvider(..., new PasswordHasherRegistry(new SCryptPassordHasher(), Seq(new BCryptPassordHasher())))\r\n```\r\n\r\ninstead of\r\n\r\n```scala\r\nnew CredentialsProvider(..., new SCryptPassordHasher(), Seq(new SCryptPassordHasher(), new BCryptPassordHasher())))\r\n```\r\n\r\nThis pull request introduces a new optional `metadata` field for the `PasswordInfo` class. so if you need a relational SQL database, then you must add this field to your database table. This additional field is needed to store additional data for a hasher which can be used to check if a password is deprecated or not. It's not needed to convert you data in the database."},"comment":{"url":"https://api.github.com/repos/mohiva/play-silhouette/issues/comments/212487311","html_url":"https://github.com/mohiva/play-silhouette/pull/461#issuecomment-212487311","issue_url":"https://api.github.com/repos/mohiva/play-silhouette/issues/461","id":212487311,"user":{"login":"alexmojaki","id":3627481,"avatar_url":"https://avatars.githubusercontent.com/u/3627481?v=3","gravatar_id":"","url":"https://api.github.com/users/alexmojaki","html_url":"https://github.com/alexmojaki","followers_url":"https://api.github.com/users/alexmojaki/followers","following_url":"https://api.github.com/users/alexmojaki/following{/other_user}","gists_url":"https://api.github.com/users/alexmojaki/gists{/gist_id}","starred_url":"https://api.github.com/users/alexmojaki/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/alexmojaki/subscriptions","organizations_url":"https://api.github.com/users/alexmojaki/orgs","repos_url":"https://api.github.com/users/alexmojaki/repos","events_url":"https://api.github.com/users/alexmojaki/events{/privacy}","received_events_url":"https://api.github.com/users/alexmojaki/received_events","type":"User","site_admin":false},"created_at":"2016-04-20T15:53:28Z","updated_at":"2016-04-20T15:53:28Z","body":"Sorry, I hadn't noticed you updated the pull request because there was still only one commit. Did you rewrite the history?\r\n\r\nAnyway, I understand that it's a pain for you to continue this discussion. You don't have to. I put a comment in the code about metadata but it's OK if you don't respond to the rant at the end.\r\n\r\nI haven't had a chance to review all the code properly. I'll let you know if there's anything else wrong or if you can go ahead."}}