A more secure and generalized approach for PDO Basic Auth Backend #1283
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Hello,
motivated by the currently insecure password hashing in sabre/dav (as discussed in Baikal #514), I developed this PR. It allows administrators to choose any password hashing function supported by
password_verify()
(among others, this includes the state of the art hashes bcrypt and Argon).Furthermore this PR is about generalized approach on using the PDO Backend with Basic Authentication. The supplied Backend allows the customization of:
I think this covers a large part of use cases and would benefit a lot of sabre/dav users.
Best Regards.