简体繁体 English

验证哈希密码（注册）php的长度

[英]Validating the length of a hashed password (registration) php

原文 2013-04-26 19:48:59 4 1 php/ javascript/ validation/ hash

Ok, well I seem to have hit a dilemma with my work. 好吧，好吧，我的工作似乎陷入了困境。 I have already got a working registration page on where the user can sign up and all the fields are validated prior to being submitted, this validation is done with the the exact users input and measures the length of the password, username etc.. client side. 我已经有了一个可以在其中注册用户的工作注册页面，并且在提交所有字段之前都对其进行了验证，该验证是通过准确的用户输入来完成的，并测量密码，用户名等的长度。客户端。

However, before the form is finally submitted the password is hashed in my hopes to stop people sniffing out passwords. 但是，在最终提交表单之前，我先对密码进行了哈希处理，以希望阻止人们嗅出密码。 So the server receives the details and the hashed password. 因此，服务器将接收详细信息和哈希密码。 My problem is if the user changes the JavaScript validation to allow for a shorter password my php script will have no way of telling. 我的问题是，如果用户更改JavaScript验证以允许输入较短的密码，我的php脚本将无法告知。 I can't allow users to have passwords shorter than 8 characters long but it's almost impossible to run validation on the hashed password? 我不能允许用户使用少于8个字符的密码，但是几乎不可能对哈希密码进行验证？

Although if the user has disables JavaScript I can validate the password as it will not of been hashed in the first place but it's if someone has altered the JavaScript to void the validation client side is where I seem to be noticing a problem. 尽管如果用户禁用了JavaScript，我可以验证密码，因为它不会首先被散列，但是如果有人更改了JavaScript以使验证客户端无效，那我似乎注意到了一个问题。 Admittedly I could use encryption and decryption but I feel there must be something I am overlooking as I always do. 诚然，我可以使用加密和解密，但是我觉得必须像往常一样忽略某些东西。

I don't really see the use of my posting my code but if that needs be I will. 我没有真正看到我发布代码的用途，但是如果需要的话，我会的。 I apologize if I'm not very clear with my explanation or if I'm missing something blatant and obvious. 如果我对自己的解释不太清楚，或者缺少明显和明显的内容，我深表歉意。

1 个解决方案

Passwords should be hashed server-side. 密码应在服务器端进行哈希处理。 Otherwise, the hash can be sniffed and replayed just as easily as a plain-text password. 否则，散列可以像纯文本密码一样被嗅探和重放。 Don't forget to uniquely salt as well. 不要忘记也要独特地加盐。

For transport, you need HTTPS. 对于传输，您需要HTTPS。