Comments (6)
So you won't fix the wrong readme and documentation? Like I said, this has already lead to bugs in other applications.
from password_compat.
This is by design. The standard approach used in PHP core is to return null
on error. However, password_verify
was deemed sensitive enough to return false
on error: see the RFC.
I'm not saying I agree 100% with it, but the standards that PHP uses on error are there for a reason. And they are only violated where security could be a concern (on verification)...
from password_compat.
i see the point about password_verify
, but what about password_hash
? the RFC states that it returns false
on any error, but this implementation returns null
on any error except the one about output length
If any error is raise, false is returned by the function.
from password_compat.
This is an issue, and it's a pretty serious one. The Laravel devs have already stumbled upon it, and I'm sure others as well.
The problem is that we're getting three mutually exclusive statements about the return value for errors:
- In your comment above, you say it should always be
null
. - The RFC and the documentation say it should always be
false
. - In the implementation, it's sometimes
null
, sometimesfalse
.
What makes this even worse is that the password_verify()
function doesn't do anything about invalid hashes. It simply returns false
unless the verifcation was sucessful. So if an application ends up storing empty hashes due to the return value confusion, the affected users will be locked out silently. Nobody will realize that there's a bug until the users complain about not being able to log in despite numerous attempts.
This applies to some of the other functions as well. The documentation is different from the RFC which in turn is different from the implementation.
I think it would be helpful if you made a definite decision and then applied this to all three places (documentation, RFC, code). I'm pretty sure the usual way of how PHP indicates errors is by returning false, not null
.
from password_compat.
I'm sorry, I should have said null
on argument errors. This means that a mix of return values can happen depending on the cause of the error.
This was discussed on-list during the proposal stage: the first mention.
The only function which should always be false
is password_verify()
, as that was the only one deemed "sensitive" enough to not return null
on argument failure.. And indeed, it does.
from password_compat.
@Jacques1 PHP does not document "returns NULL on parameter parsing failure" for every function - because it always applies (unless otherwise specified).
from password_compat.
Related Issues (20)
- password_verify fails for hashes from crypt() HOT 3
- mysqli_real_escape_string
- PASSWORD_ARGON2I Algo Support HOT 1
- Password verify issues HOT 1
- php7 Compatibility problem HOT 5
- PHPCompatibility ruleset for password_compat
- Trouble with PHP 5.6 & Password Verify HOT 1
- A HOT 1
- A
- Function not outputting the same hash as built-in function HOT 8
- Bcrypt issue HOT 1
- function_exists('PasswordCompat\\binary\\_strlen') needed? HOT 4
- password_hash("foo") returning false on 5.3.2-1ubuntu4.30 HOT 7
- Cannot verify the password after hashing HOT 1
- Suggestion: use *.phpt tests from php-src to improve compatibility
- Problem with verifiying the hashed password HOT 3
- Using the project on a newer version of PHP HOT 2
- This Repo HOT 7
- use password_compact in codeigniter HOT 2
- This lib on php 5.5 HOT 6
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from password_compat.