plataformatec/devise — Issue #1589: How to alter the password send by POST
Author: taliking
Created: 2012-01-23 10:31:42+00:00
State: open

Hi!

I'm having a "problem" with the authentification.

Status Quo: username -> test and password -> 123456
in database: username -> test and password -> $2a$10$7Iit/nLVHd3Rqppqmp7pheybjuSyhwjJwxUC7rMAPB8O7ifwpoEb. [encrypted 123456 (standard of devise, created by "sign_up")]

The Sign In works, if the app sends "test", "123456" and the authenticity token per POST method.

Now we don't want to send the clear_text password, but an encrypted one, something like:

"test" , "xyz" and the auth. token.

Also we're getting our user table from the company which just writes the data in the devise model, bypassing the sign_up-encryption process.

So the situation is like:

DB: username -> "test", password ->"abc" [encrypted with ALG1]
APP sends: username -> "test", password -> "xyz" [encrypted with ALG2]

Now the API needs to decrypt "xyz" to the clear_text password and encrypt it with ALG1 to "abc" to authenticate with the database.

The decryption / encryption method is working, if I enter the password manually.

Finally my question: How do I catch the password to redirect it to the decryption / encryption method and send it back to the sign_in process?