Recently, one of my teams wanted to update their password hashing algorithm that was in use for more than 2 years. As discussed here, passwords should always be hashed in the database.
If we directly employ the new hashing algorithm, then all users would lose the ability to login with their old passwords and would be forced to change their password.
Hence, we need to follow the following approach:
1. Add a new column to the user table that stores the hashing algorithm name (or version).
2. Set this version to 1 for all old passwords.
3. When the user logs in, first check the hash using the old algorithm. If it is correct, then hash the password using the new algorithm and save the hash.
4. Update the version column to 2.
If we directly employ the new hashing algorithm, then all users would lose the ability to login with their old passwords and would be forced to change their password.
Hence, we need to follow the following approach:
1. Add a new column to the user table that stores the hashing algorithm name (or version).
2. Set this version to 1 for all old passwords.
3. When the user logs in, first check the hash using the old algorithm. If it is correct, then hash the password using the new algorithm and save the hash.
4. Update the version column to 2.
No comments:
Post a Comment