Home > Article > Backend Development > Auth uses salt and password for user authentication examples
Auth uses salt and password for user authentication examples
- 小云云Original
- 2018-01-26 11:11:172250browse
This article mainly introduces you to the relevant information about using salt and password to authenticate users by modifying Laravel Auth. The article introduces it in detail through the example code. It has certain reference value for everyone's study or work. I hope it can help. Everyone.
Laraval’s own user authentication system Auth is very powerful and easy to use. However, in Laravel’s user authentication system, user registration, login, and password retrieval modules use password encryption and authentication algorithms. bcrypt, and many previous projects use the method of storing salt + password encrypted strings to record user passwords in the user table. This has brought great resistance to using the Laravel framework to reconstruct previous projects. However, I recently completed the modification of Laravel Auth by searching for information on the Internet, reading community forums, and reading source code. I hope it will be helpful to others by sharing it here. Before I begin, I need to explain that if the Laravel framework is used in a new project, there is no need to make any modifications to Auth. The default bcrypt encryption algorithm is a more secure and efficient encryption algorithm than salt + password.
Modify user registration
First, enable verification in laravel using the artisan command
php artisan make:auth
After executing the command, in the routes file (location: app/Http /routes.php) will have one more static method call
Route::auth();
This Route is a Facade of Laravel (located in Illuminate\Support\Facades\Route), and the called auth method is defined in the Illuminate\Routing\Router class. As you can see below, the auth method defines some Auth-related routing rules
/**
* Register the typical authentication routes for an application.
*
* @return void
*/
public function auth()
{
// Authentication Routes...
$this->get('login', 'Auth\AuthController@showLoginForm');
$this->post('login', 'Auth\AuthController@login');
$this->get('logout', 'Auth\AuthController@logout');
// Registration Routes...
$this->get('register', 'Auth\AuthController@showRegistrationForm');
$this->post('register', 'Auth\AuthController@register');
// Password Reset Routes...
$this->get('password/reset/{token?}', 'Auth\PasswordController@showResetForm');
$this->post('password/email', 'Auth\PasswordController@sendResetLinkEmail');
$this->post('password/reset', 'Auth\PasswordController@reset');
}
Through the routing rules, you can see that the controller method requested during registration is the register method of AuthController, which is defined in \Illuminate\Foundation In the traits \Auth\RegistersUsers, AuthController introduced this trait in the class definition.
/**
* Handle a registration request for the application.
*
* @param \Illuminate\Http\Request $request
* @return \Illuminate\Http\Response
*/
public function register(Request $request)
{
$validator = $this->validator($request->all());
if ($validator->fails()) {
$this->throwValidationException(
$request, $validator
);
}
Auth::guard($this->getGuard())->login($this->create($request->all()));
return redirect($this->redirectPath());
}
In the register method, the user input data in the request will first be verified. You only need to verify it in the validator method of AuthController. Just define your own verification rules for each input field
protected function validator(array $data)
{
return Validator::make($data, [
'name' => 'required|max:255',
'email' => 'required|email|max:255|unique:user',
'password' => 'required|size:40|confirmed',
]);
}
Then look down. After the verification is passed, Laravel will use the create method of AuthController to generate a new user, and then use the new user's data to log in to Auth. ::guard($this->getGuard())->login($this->create($request->all()));
So we need to customize the user registration To generate the encryption method of user password, you only need to modify the create method of AuthController.
For example:
/**
* Create a new user instance after a valid registration.
*
* @param array $data
* @return User
*/
protected function create(array $data)
{
$salt = Str::random(6);
return User::create([
'nickname' => $data['name'],
'email' => $data['email'],
'password' => sha1($salt . $data['password']),
'register_time' => time(),
'register_ip' => ip2long(request()->ip()),
'salt' => $salt
]);
}
Modify user login
Before modifying login, we need to first look at the specific controller and method of the login request through routing rules. In the auth method definition mentioned above, you can see that
$this->get('login', 'Auth\AuthController@showLoginForm');
$this->post('login', 'Auth\AuthController@login');
$this->get('logout', 'Auth\AuthController@logout');
The login verification operation is in the login method of the \App\Http\Controllers\Auth\AuthController class. Open AuthController and find that Auth-related methods are introduced into the class through traits. Use the traits to be introduced in the class. During compilation, PHP will copy the code in the traits into the class. This is PHP5.5 The specific applicable scenarios and uses of the introduced features will not be detailed here. So the AuthController@login method is actually defined in the
\Illuminate\Foundation\Auth\AuthenticatesUsers traits.
/**
* Handle a login request to the application.
*
* @param \Illuminate\Http\Request $request
* @return \Illuminate\Http\Response
*/
public function login(Request $request)
{
$this->validateLogin($request);
$throttles = $this->isUsingThrottlesLoginsTrait();
if ($throttles && $lockedOut = $this->hasTooManyLoginAttempts($request)) {
$this->fireLockoutEvent($request);
return $this->sendLockoutResponse($request);
}
$credentials = $this->getCredentials($request);
if (Auth::guard($this->getGuard())->attempt($credentials, $request->has('remember'))) {
return $this->handleUserWasAuthenticated($request, $throttles);
}
if ($throttles && ! $lockedOut) {
$this->incrementLoginAttempts($request);
}
return $this->sendFailedLoginResponse($request);
}
The main operation of login verification is in Auth::guard($this->getGuard( ))->attempt($credentials, $request->has('remember')); This method is called, and Auth::guard($this->getGuard()) obtains\ Illuminate\Auth\SessionGuard (For details on how to obtain it, see the source code in the Auth Facade \Illuminate\Auth\AuthManager)
Look at how the attempt method in SessionGuard is implemented:
public function attempt(array $credentials = [], $remember = false, $login = true)
{
$this->fireAttemptEvent($credentials, $remember, $login);
$this->lastAttempted = $user = $this->provider->retrieveByCredentials($credentials);
if ($this->hasValidCredentials($user, $credentials)) {
if ($login) {
$this->login($user, $remember);
}
return true;
}
if ($login) {
$this->fireFailedEvent($user, $credentials);
}
return false;
}
/**
* Determine if the user matches the credentials.
*
* @param mixed $user
* @param array $credentials
* @return bool
*/
protected function hasValidCredentials($user, $credentials)
{
return ! is_null($user) && $this->provider->validateCredentials($user, $credentials);
}
retrieveByCredentials is The user data is retrieved from the database using the fields passed in. validateCredentials is the actual process used to verify whether the password is correct.
What needs to be noted here is that $this->provider is a provider that implements the \Illuminate\Contracts\Auth\UserProvider class. We see that there are two implementations of UserProvider under the directory Illuminate\Auth. They are DatabaseUserProvider and EloquentUserProvider respectively, but when we verify the password, which one is used to verify it? Take a look at the auth configuration file
'providers' => [ 'users' => [ 'driver' => 'eloquent', 'model' => App\User::class, //这个是driver用的Model ], ],
What is configured here is driver => eloquent, then it is through retrieveByCredentials of EloquentUserProvider Verified, this EloquentUserProvider is injected when SessionGuard is instantiated. (For details on how to read the auth configuration file and instantiate the corresponding provider and inject it into SessionGuard, please refer to the source of the createSessionDriver method in \Illuminate\Auth\AuthManager. Code)
Next we continue to look at the implementation of the retrieveByCredentials and validateCredentials methods in EloquentUserProvider:
/**
* Retrieve a user by the given credentials.
*
* @param array $credentials
* @return \Illuminate\Contracts\Auth\Authenticatable|null
*/
public function retrieveByCredentials(array $credentials)
{
if (empty($credentials)) {
return;
}
$query = $this->createModel()->newQuery();
foreach ($credentials as $key => $value) {
if (! Str::contains($key, 'password')) {
$query->where($key, $value);
}
}
return $query->first();
}
/**
* Validate a user against the given credentials.
*
* @param \Illuminate\Contracts\Auth\Authenticatable $user
* @param array $credentials
* @return bool
*/
public function validateCredentials(UserContract $user, array $credentials)
{
$plain = $credentials['password'];
return $this->hasher->check($plain, $user->getAuthPassword());
}
The above two methods retrieveByCredentials use fields other than passwords to retrieve user records from the database user table, such as Use email to query the user record, and then the validateCredentials method uses $this->haser->check to compare the entered password with the hashed password to verify whether the password is correct.
好了， 看到这里就很明显了， 我们需要改成自己的密码验证就是自己实现一下validateCredentials就可以了， 修改$this->hasher->check为我们自己的密码验证规则就可以了。
首先我们修改$user->getAuthPassword()把数据库中用户表的salt和password传递到validateCredentials中
修改App\User.php 添加如下代码
/** * The table associated to this model */ protected $table = 'user';／／用户表名不是laravel约定的这里要指定一下
/**
* 禁用Laravel自动管理timestamp列
*/
public $timestamps = false;
/**
* 覆盖Laravel中默认的getAuthPassword方法, 返回用户的password和salt字段
* @return type
*/
public function getAuthPassword()
{
return ['password' => $this->attributes['password'], 'salt' => $this->attributes['salt']];
}
然后我们在建立一个自己的UserProvider接口的实现，放到自定义的目录中：
新建app/Foundation/Auth/AdminEloquentUserProvider.php
namespace App\Foundation\Auth;
use Illuminate\Auth\EloquentUserProvider;
use Illuminate\Contracts\Auth\Authenticatable;
use Illuminate\Support\Str;
class AdminEloquentUserProvider extends EloquentUserProvider
{
/**
* Validate a user against the given credentials.
*
* @param \Illuminate\Contracts\Auth\Authenticatable $user
* @param array $credentials
*/
public function validateCredentials(Authenticatable $user, array $credentials) {
$plain = $credentials['password'];
$authPassword = $user->getAuthPassword();
return sha1($authPassword['salt'] . $plain) == $authPassword['password'];
}
}
最后我们修改auth配置文件让Laravel在做Auth验证时使用我们刚定义的Provider，
修改config/auth.php：
'providers' => [ 'users' => [ 'driver' => 'admin-eloquent', 'model' => App\User::class, ] ]
修改app/Provider/AuthServiceProvider.php
public function boot(GateContract $gate)
{
$this->registerPolicies($gate);
\Auth::provider('admin-eloquent', function ($app, $config) {
return New \App\Foundation\Auth\AdminEloquentUserProvider($app['hash'], $config['model']);
});
}
Auth::provider方法是用来注册Provider构造器的，这个构造器是一个Closure，provider方法的具体代码实现在AuthManager文件里
public function provider($name, Closure $callback)
{
$this->customProviderCreators[$name] = $callback;
return $this;
}
闭包返回了AdminEloquentUserProvider对象供Laravel Auth使用，好了做完这些修改后Laravel的Auth在做用户登录验证的时候采用的就是自定义的salt + password的方式了。
修改重置密码
Laravel 的重置密码的工作流程是：
向需要重置密码的用户的邮箱发送一封带有重置密码链接的邮件，链接中会包含用户的email地址和token。
用户点击邮件中的链接在重置密码页面输入新的密码，Laravel通过验证email和token确认用户就是发起重置密码请求的用户后将新密码更新到用户在数据表的记录里。
第一步需要配置Laravel的email功能，此外还需要在数据库中创建一个新表password_resets来存储用户的email和对应的token
CREATE TABLE `password_resets` ( `email` varchar(255) COLLATE utf8_unicode_ci NOT NULL, `token` varchar(255) COLLATE utf8_unicode_ci NOT NULL, `created_at` timestamp NOT NULL, KEY `password_resets_email_index` (`email`), KEY `password_resets_token_index` (`token`) ) ENGINE=InnoDB DEFAULT CHARSET=utf8 COLLATE=utf8_unicode_ci;
通过重置密码表单的提交地址可以看到，表单把新的密码用post提交给了/password/reset，我们先来看一下auth相关的路由，确定/password/reset对应的控制器方法。
$this->post('password/reset', 'Auth\PasswordController@reset');
可以看到对应的控制器方法是\App\Http\Controllers\Auth\PasswordController类的reset方法，这个方法实际是定义在\Illuminate\Foundation\Auth\ResetsPasswords 这个traits里，PasswordController引入了这个traits
/**
* Reset the given user's password.
*
* @param \Illuminate\Http\Request $request
* @return \Illuminate\Http\Response
*/
public function reset(Request $request)
{
$this->validate(
$request,
$this->getResetValidationRules(),
$this->getResetValidationMessages(),
$this->getResetValidationCustomAttributes()
);
$credentials = $this->getResetCredentials($request);
$broker = $this->getBroker();
$response = Password::broker($broker)->reset($credentials, function ($user, $password) {
$this->resetPassword($user, $password);
});
switch ($response) {
case Password::PASSWORD_RESET:
return $this->getResetSuccessResponse($response);
default:
return $this->getResetFailureResponse($request, $response);
}
}
方法开头先通过validator对输入进行验证,接下来在程序里传递把新密码和一个闭包对象传递给Password::broker($broker)->reset();方法，这个方法定义在\Illuminate\Auth\Passwords\PasswordBroker类里.
/**
* Reset the password for the given token.
*
* @param array $credentials
* @param \Closure $callback
* @return mixed
*/
public function reset(array $credentials, Closure $callback)
{
// If the responses from the validate method is not a user instance, we will
// assume that it is a redirect and simply return it from this method and
// the user is properly redirected having an error message on the post.
$user = $this->validateReset($credentials);
if (! $user instanceof CanResetPasswordContract) {
return $user;
}
$pass = $credentials['password'];
// Once we have called this callback, we will remove this token row from the
// table and return the response from this callback so the user gets sent
// to the destination given by the developers from the callback return.
call_user_func($callback, $user, $pass);
$this->tokens->delete($credentials['token']);
return static::PASSWORD_RESET;
}
在PasswordBroker的reset方法里，程序会先对用户提交的数据做再一次的认证，然后把密码和用户实例传递给传递进来的闭包，在闭包调用里完成了将新密码更新到用户表的操作， 在闭包里程序调用了的PasswrodController类的resetPassword方法
function ($user, $password) {
$this->resetPassword($user, $password);
});
PasswrodController类resetPassword方法的定义
protected function resetPassword($user, $password)
{
$user->forceFill([
'password' => bcrypt($password),
'remember_token' => Str::random(60),
])->save();
Auth::guard($this->getGuard())->login($user);
}
在这个方法里Laravel 用的是bcrypt 加密了密码， 那么要改成我们需要的salt + password的方式，我们在PasswordController类里重写resetPassword方法覆盖掉traits里的该方法就可以了。
/**
* 覆盖ResetsPasswords traits里的resetPassword方法,改为用sha1(salt + password)的加密方式
* Reset the given user's password.
*
* @param \Illuminate\Contracts\Auth\CanResetPassword $user
* @param string $password
* @return void
*/
protected function resetPassword($user, $password)
{
$salt = Str::random(6);
$user->forceFill([
'password' => sha1($salt . $password),
'salt' => $salt,
'remember_token' => Str::random(60),
])->save();
\Auth::guard($this->getGuard())->login($user);
}
结语
到这里对Laravel Auth的自定义就完成了，注册、登录和重置密码都改成了sha1(salt + password)的密码加密方式， 所有自定义代码都是通过定义Laravel相关类的子类和重写方法来完成没有修改Laravel的源码，这样既保持了良好的可扩展性也保证了项目能够自由迁移。
注：使用的Laravel版本为5.2
相关推荐：
Laravel5.5中利用Passport实现Auth认证的方法
The above is the detailed content of Auth uses salt and password for user authentication examples. For more information, please follow other related articles on the PHP Chinese website!