A yesod-auth AuthPlugin designed to look users up in Persist where their user id's and a hash of their password is stored.

This module was removed from yesod-auth-1.3.0.0 and is now maintained separately. Versions of this module prior to yesod-auth-1.3 used a relatively weak hashing algorithm (a single round of SHA1) which does not provide adequate protection against an attacker who discovers the hashed passwords. See: https://github.com/yesodweb/yesod/issues/668.

It has now been rewritten to use Crypto.PasswordStore, but this has been done in a way which preserves compatibility both with the API and with databases which have been set up using older versions of this module. There are two levels of database compatibility:

• The verification code recognises both the old and new hash formats, so passwords can be verified against database entries which still contain old-style hashes.
  • The function upgradePasswordHash can be used to migrate existing user records to use the new format hash. Unlike freshly created password hashes, entries converted this way must still have the old salt field, since the old hash function remains part of the algorithm needed for verification. (The new hash is layered on top of the old one.)

On the other hand, new passwords set up by setPassword or setPasswordStrength no longer use a separate salt field, so new users of this module need only provide a single password field in the user data, and can ignore the salt.

In a system which has been migrated from the old format, passwords which are reset using the new format will have an empty salt field. Once all the entries are of this form, it is safe to change the model to remove the salt, and change the HashDBUser instance accordingly.

To use this in a Yesod application, it must be an instance of YesodPersist, and the username and hashed-passwords should be added to the database. The followng steps give an outline of what is required.

You need a database table to store user records: in a scaffolded site it might look like:

User
    name Text             -- user name used by HashDB
    password Text Maybe   -- password hash for HashDB
    UniqueUser name

Create an instance of HashDBUser for this data type:

instance HashDBUser User where
    userPasswordHash = userPassword
    setPasswordHash h p = p { userPassword = Just h }

In the YesodAuth instance declaration for your app, include authHashDB like so:

instance YesodAuth App where
    ....
    authPlugins _ = [ authHashDB (Just . UniqueUser), .... ]
    getAuthId = getAuthIdHashDB AuthR (Just . UniqueUser)

AuthR should be your authentication route, and the function (Just . UniqueUser) supplied to both authHashDB and getAuthIdHashDB takes a Text and produces a Unique value to look up in the User table. getAuthIdHashDB is just a convenience for the case when HashDB is the only plugin, and something else would be needed when other plugins are used as well.

You can create password hashes manually as follows, if you need to initialise the database:

ghci -XOverloadedStrings
> import Crypto.PasswordStore
> makePassword "MyPassword" 14

where "14" is the default strength parameter used in this module.