micahlmartin/OAuth2Provider — pull request #7 by naasir (2012-10-09 22:58:04+00:00)
Title: Make password checking algorithm configurable

Hey Micahl,

First off, thanks for all your hard work on the .NET OAuth 2.0 provider. I found it to be the simplest solution to grok and work with.

Based on the ideas you outlined in your open issue on [making password hashing agnostic](https://github.com/micahlmartin/OAuth2Provider/issues/6), I've created a patch to address this concern. Instead of exposing a hash function however, I'm exposing a function to compare a password with a stored hash. I did this because most of the recommended password hashing functions (BCrypt, SCrypt) recommend hashing a password with a salt. If we were to expose a function that generated a hash, we would have to ask for this salt too. In reality though, all we care about is whether the password is correct or not, so I'm letting the consumer of the library dictate that. Hope that makes sense.

Let me know if I've overlooked something. Thanks.