#5895 - Hash and salt the member_hash value in the database like we do passwords
| Identifier | #5895 |
|---|---|
| Issue type | Feature request or suggestion |
| Title | Hash and salt the member_hash value in the database like we do passwords |
| Status | Completed |
| Tags |
Roadmap: v11 (custom) Type: Security (custom) |
| Handling member | PDStig |
| Version | 11 beta1 |
| Addon | core_cns |
| Description | The value of the member_hash cookie was getting stored in the database in plain-text format. This is not ideal in the event of a database leak as these cookies last a long time. Treat this like we would a password, so Bcrypt and salt it in the database, and verify against the stored hash. |
| Steps to reproduce | |
| Funded? | No |
| Commits |
The system will post a comment when this issue is modified (e.g., status changes). To be notified of this, click "Enable comment notifications".


Comments