jaliss/securesocial — Issue #32: Customize password hash in UsernamePasswordProvider? 
Author: vasil-p
Created: 2012-02-12 12:09:56+00:00
State: open

Hi

from the source I can see that the UsernamePasswordProvider does a password check by using the play.libs.Crypto.passwordHash(String) method.

This enforces the user store to use the same method (or to store the password in plain text).

It wouldn't be a problem if the default hash algorithm in the play.libs.Crypto wasn't MD5 which has some security issues and is inferior to the other hashing algorythms supported ther (SHA-1 SHA-256 etc).

Is there any way to customize the password hash, except for changing the module code?
Even more - is there any way to customize the password check in UsernamePasswordProvider so that a user provided one is used (in case I don't want to use the play.libs.Crypto)?

Thank you
Vasil