散列用户密码 - 身份服务器

Question

I'm currently working with Identity Server 4, at present when the user logs in I need to hash their provided password and then compare with the password stored in the database (also hashed)

After some searching, I was linked to the PasswordHasher within Identity Server to handle this:

  var _hasher = new PasswordHasher<User>();
  var hashpassword = _hasher.HashPassword(user, context.Password);

User is my custom class that inherits from IdentityUser , however, when checking the hashed password against the one in the database the hash is completely different, I have double checked the password and I can confirm it's correct.

Can anyone suggest why I maybe seeing a different hash compared to the one in the database?

Answer 1

Each time you hash a password with PasswordHasher<T>.HashPassword you will get a total different result because of the salt .

To verify such hashed salted passwords use the given method IPasswordHasher<T>.VerifyPassword .