jaliss/securesocial — pull request #42 by kaiinkinen (2012-04-19 12:52:48+00:00)
Title: Configurable password hasher for SecureSocial

Our project needs to implement some basic password authentication, and we will later have to add various external providers, so I decided to use SecureSocial. However, the default password hashing in Play is _bad_, using plain MD5 hashing without any salt.

Overriding whole classes in SecureSocial is fairly easy, but clearly overkill if I just want to configure how the hashing is done. I created a configuration mechanism, where the user can override the interface

securesocial.utils.PasswordHasher

with a custom hasher function. There is also a configuration option called
securesocial.password.hasher=

which allows selecting the hasher implementation class to use.

The default functionality has been preserved, so if the configuration is omitted the old functionality is used.

br.
.kai.inkinen