The only segment of code that surface the "salt" is as follow:
trait MyPasswordTypedField[OwnerType <: Record[OwnerType]] extends Field[String, OwnerType] with PasswordTypedField
{
def mySalt =
{
val myValue = valueBox.map(v => v.toString) openOr ""
if(myValue.isEmpty || myValue.length <= 28)
salt.get
else
myValue.substring(28)
}
...
Peter Petersson
unread,
Oct 7, 2012, 5:36:42 AM10/7/12
Reply to author
Sign in to reply to author
Forward
Sign in to forward
Delete
You do not have permission to delete messages in this group
Copy link
Report message
Show original message
Either email addresses are anonymous for this group or you need the view member email addresses permission to view the original message
to lif...@googlegroups.com, Kevin Lau
Hi Lau
I will take a look at it. This code was published when there was a
salt:ing discussion going on regarding record.
I have not done much work in lift involving record and user
authentication lately but I think there may be some newer and
better ways to handle it in lift 2.5 maybe David W can elaborate
on that.
You do not have permission to delete messages in this group
Copy link
Report message
Show original message
Either email addresses are anonymous for this group or you need the view member email addresses permission to view the original message
to lif...@googlegroups.com
I just took a quick look at the code
and the reason it dose not compile for lift 2.5-M1 is that there
are no longer a concrete value member 'salt' in the
net.liftweb.record.field.PasswordTypedField trait and I am not
sure how to get around this.
There is probably some new slicker mechanism for
retrieving/holding the salt in lift 2.5 record
... maybe someone already have a blog post or something showing
how it should be done in 2.5 ?
best regards
Peter Petersson
On 10/06/2012 11:14 PM, Kevin Lau wrote:
Peter Petersson
unread,
Oct 7, 2012, 4:05:36 PM10/7/12
Reply to author
Sign in to reply to author
Forward
Sign in to forward
Delete
You do not have permission to delete messages in this group
Copy link
Report message
Show original message
Either email addresses are anonymous for this group or you need the view member email addresses permission to view the original message
to lif...@googlegroups.com
Resolved:
After taking a close look at this I found out that the password
filed is salted by default (in 2.5) so you do not need to extend
it with your own trait :)
so in class User modify the password field like this:
:
val password = new PasswordField(this) //with
MyPasswordTypedField[User]
:
i.e remove the trait extension.
I will do a initial clean up of the example code in a moment and
get back to it later to get rid of more dead code.
best regards
Peter Petersson
On 10/06/2012 11:14 PM, Kevin Lau wrote:
Peter Petersson
unread,
Oct 7, 2012, 4:14:27 PM10/7/12
Reply to author
Sign in to reply to author
Forward
Sign in to forward
Delete
You do not have permission to delete messages in this group
Copy link
Report message
Show original message
Either email addresses are anonymous for this group or you need the view member email addresses permission to view the original message
to lif...@googlegroups.com
... my conclusion that the password
field is salted by default may be a bit hasty (still using hashpw
with BCrypt for that)
... anyway you do not need to override the match_? function and
other stuff in PasswordTypedField anymore to have a salted
password.
best regards
Peter Petersson
Peter Petersson
unread,
Oct 7, 2012, 4:29:41 PM10/7/12
Reply to author
Sign in to reply to author
Forward
Sign in to forward
Delete
You do not have permission to delete messages in this group
Copy link
Report message
Show original message
Either email addresses are anonymous for this group or you need the view member email addresses permission to view the original message
to lif...@googlegroups.com
The Basic-SquerylRecord-User-Setup
example [1] is now updated to work with Lift 2.5-M1