Browse Source
This implements HTTP basicauth into Caddy 2. The basic auth module will not work with passwords that are not securely hashed, so a subcommand hash-password was added to make it convenient to produce those hashes. Also included is Caddyfile support. Closes #2747.master
6 changed files with 562 additions and 0 deletions
@ -0,0 +1,164 @@ |
|||||
|
// Copyright 2015 Matthew Holt and The Caddy Authors
|
||||
|
//
|
||||
|
// Licensed under the Apache License, Version 2.0 (the "License");
|
||||
|
// you may not use this file except in compliance with the License.
|
||||
|
// You may obtain a copy of the License at
|
||||
|
//
|
||||
|
// http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
//
|
||||
|
// Unless required by applicable law or agreed to in writing, software
|
||||
|
// distributed under the License is distributed on an "AS IS" BASIS,
|
||||
|
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
|
// See the License for the specific language governing permissions and
|
||||
|
// limitations under the License.
|
||||
|
|
||||
|
package caddyauth |
||||
|
|
||||
|
import ( |
||||
|
"crypto/sha256" |
||||
|
"crypto/subtle" |
||||
|
"encoding/json" |
||||
|
"fmt" |
||||
|
"net/http" |
||||
|
|
||||
|
"github.com/caddyserver/caddy/v2" |
||||
|
) |
||||
|
|
||||
|
func init() { |
||||
|
caddy.RegisterModule(HTTPBasicAuth{}) |
||||
|
} |
||||
|
|
||||
|
// HTTPBasicAuth facilitates HTTP basic authentication.
|
||||
|
type HTTPBasicAuth struct { |
||||
|
HashRaw json.RawMessage `json:"hash,omitempty"` |
||||
|
AccountList []Account `json:"accounts,omitempty"` |
||||
|
Realm string `json:"realm,omitempty"` |
||||
|
|
||||
|
Accounts map[string]Account `json:"-"` |
||||
|
Hash Comparer `json:"-"` |
||||
|
} |
||||
|
|
||||
|
// CaddyModule returns the Caddy module information.
|
||||
|
func (HTTPBasicAuth) CaddyModule() caddy.ModuleInfo { |
||||
|
return caddy.ModuleInfo{ |
||||
|
Name: "http.handlers.authentication.providers.http_basic", |
||||
|
New: func() caddy.Module { return new(HTTPBasicAuth) }, |
||||
|
} |
||||
|
} |
||||
|
|
||||
|
// Provision provisions the HTTP basic auth provider.
|
||||
|
func (hba *HTTPBasicAuth) Provision(ctx caddy.Context) error { |
||||
|
if hba.HashRaw == nil { |
||||
|
return fmt.Errorf("passwords must be hashed, so a hash must be defined") |
||||
|
} |
||||
|
|
||||
|
// load password hasher
|
||||
|
hashIface, err := ctx.LoadModuleInline("algorithm", "http.handlers.authentication.hashes", hba.HashRaw) |
||||
|
if err != nil { |
||||
|
return fmt.Errorf("loading password hasher module: %v", err) |
||||
|
} |
||||
|
hba.Hash = hashIface.(Comparer) |
||||
|
hba.HashRaw = nil // allow GC to deallocate
|
||||
|
|
||||
|
if hba.Hash == nil { |
||||
|
return fmt.Errorf("hash is required") |
||||
|
} |
||||
|
|
||||
|
// load account list
|
||||
|
hba.Accounts = make(map[string]Account) |
||||
|
for _, acct := range hba.AccountList { |
||||
|
if _, ok := hba.Accounts[acct.Username]; ok { |
||||
|
return fmt.Errorf("username is not unique: %s", acct.Username) |
||||
|
} |
||||
|
hba.Accounts[acct.Username] = acct |
||||
|
} |
||||
|
hba.AccountList = nil // allow GC to deallocate
|
||||
|
|
||||
|
return nil |
||||
|
} |
||||
|
|
||||
|
// Authenticate validates the user credentials in req and returns the user, if valid.
|
||||
|
func (hba HTTPBasicAuth) Authenticate(w http.ResponseWriter, req *http.Request) (User, bool, error) { |
||||
|
username, plaintextPasswordStr, ok := req.BasicAuth() |
||||
|
|
||||
|
// if basic auth is missing or invalid, prompt for credentials
|
||||
|
if !ok { |
||||
|
// browsers show a message that says something like:
|
||||
|
// "The website says: <realm>"
|
||||
|
// which is kinda dumb, but whatever.
|
||||
|
realm := hba.Realm |
||||
|
if realm == "" { |
||||
|
realm = "restricted" |
||||
|
} |
||||
|
|
||||
|
w.Header().Set("WWW-Authenticate", fmt.Sprintf(`Basic realm="%s"`, realm)) |
||||
|
|
||||
|
return User{}, false, nil |
||||
|
} |
||||
|
|
||||
|
plaintextPassword := []byte(plaintextPasswordStr) |
||||
|
|
||||
|
account, accountExists := hba.Accounts[username] |
||||
|
// don't return early if account does not exist; we want
|
||||
|
// to try to avoid side-channels that leak existence
|
||||
|
|
||||
|
same, err := hba.Hash.Compare(account.Password, plaintextPassword, account.Salt) |
||||
|
if err != nil { |
||||
|
return User{}, false, err |
||||
|
} |
||||
|
if !same || !accountExists { |
||||
|
return User{}, false, nil |
||||
|
} |
||||
|
|
||||
|
return User{ID: username}, true, nil |
||||
|
} |
||||
|
|
||||
|
// Comparer is a type that can securely compare
|
||||
|
// a plaintext password with a hashed password
|
||||
|
// in constant-time. Comparers should hash the
|
||||
|
// plaintext password and then use constant-time
|
||||
|
// comparison.
|
||||
|
type Comparer interface { |
||||
|
// Compare returns true if the result of hashing
|
||||
|
// plaintextPassword with salt is hashedPassword,
|
||||
|
// false otherwise. An error is returned only if
|
||||
|
// there is a technical/configuration error.
|
||||
|
Compare(hashedPassword, plaintextPassword, salt []byte) (bool, error) |
||||
|
} |
||||
|
|
||||
|
type quickComparer struct{} |
||||
|
|
||||
|
func (quickComparer) Compare(theirHash, plaintext, _ []byte) (bool, error) { |
||||
|
ourHash := quickHash(plaintext) |
||||
|
return hashesMatch(ourHash, theirHash), nil |
||||
|
} |
||||
|
|
||||
|
func hashesMatch(pwdHash1, pwdHash2 []byte) bool { |
||||
|
return subtle.ConstantTimeCompare(pwdHash1, pwdHash2) == 1 |
||||
|
} |
||||
|
|
||||
|
// quickHash returns the SHA-256 of v. It
|
||||
|
// is not secure for password storage, but
|
||||
|
// it is useful for efficiently normalizing
|
||||
|
// the length of plaintext passwords for
|
||||
|
// constant-time comparisons.
|
||||
|
//
|
||||
|
// Errors are discarded.
|
||||
|
func quickHash(v []byte) []byte { |
||||
|
h := sha256.New() |
||||
|
h.Write([]byte(v)) |
||||
|
return h.Sum(nil) |
||||
|
} |
||||
|
|
||||
|
// Account contains a username, password, and salt (if applicable).
|
||||
|
type Account struct { |
||||
|
Username string `json:"username"` |
||||
|
Password []byte `json:"password"` |
||||
|
Salt []byte `json:"salt,omitempty"` // for algorithms where external salt is needed
|
||||
|
} |
||||
|
|
||||
|
// Interface guards
|
||||
|
var ( |
||||
|
_ caddy.Provisioner = (*HTTPBasicAuth)(nil) |
||||
|
_ Authenticator = (*HTTPBasicAuth)(nil) |
||||
|
) |
@ -0,0 +1,102 @@ |
|||||
|
// Copyright 2015 Matthew Holt and The Caddy Authors
|
||||
|
//
|
||||
|
// Licensed under the Apache License, Version 2.0 (the "License");
|
||||
|
// you may not use this file except in compliance with the License.
|
||||
|
// You may obtain a copy of the License at
|
||||
|
//
|
||||
|
// http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
//
|
||||
|
// Unless required by applicable law or agreed to in writing, software
|
||||
|
// distributed under the License is distributed on an "AS IS" BASIS,
|
||||
|
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
|
// See the License for the specific language governing permissions and
|
||||
|
// limitations under the License.
|
||||
|
|
||||
|
package caddyauth |
||||
|
|
||||
|
import ( |
||||
|
"encoding/json" |
||||
|
"fmt" |
||||
|
"log" |
||||
|
"net/http" |
||||
|
|
||||
|
"github.com/caddyserver/caddy/v2" |
||||
|
"github.com/caddyserver/caddy/v2/modules/caddyhttp" |
||||
|
) |
||||
|
|
||||
|
func init() { |
||||
|
caddy.RegisterModule(Authentication{}) |
||||
|
} |
||||
|
|
||||
|
// Authentication is a middleware which provides user authentication.
|
||||
|
type Authentication struct { |
||||
|
ProvidersRaw map[string]json.RawMessage `json:"providers,omitempty"` |
||||
|
|
||||
|
Providers map[string]Authenticator `json:"-"` |
||||
|
} |
||||
|
|
||||
|
// CaddyModule returns the Caddy module information.
|
||||
|
func (Authentication) CaddyModule() caddy.ModuleInfo { |
||||
|
return caddy.ModuleInfo{ |
||||
|
Name: "http.handlers.authentication", |
||||
|
New: func() caddy.Module { return new(Authentication) }, |
||||
|
} |
||||
|
} |
||||
|
|
||||
|
// Provision sets up a.
|
||||
|
func (a *Authentication) Provision(ctx caddy.Context) error { |
||||
|
a.Providers = make(map[string]Authenticator) |
||||
|
for modName, rawMsg := range a.ProvidersRaw { |
||||
|
val, err := ctx.LoadModule("http.handlers.authentication.providers."+modName, rawMsg) |
||||
|
if err != nil { |
||||
|
return fmt.Errorf("loading authentication provider module '%s': %v", modName, err) |
||||
|
} |
||||
|
a.Providers[modName] = val.(Authenticator) |
||||
|
} |
||||
|
a.ProvidersRaw = nil // allow GC to deallocate
|
||||
|
|
||||
|
return nil |
||||
|
} |
||||
|
|
||||
|
func (a Authentication) ServeHTTP(w http.ResponseWriter, r *http.Request, next caddyhttp.Handler) error { |
||||
|
var user User |
||||
|
var authed bool |
||||
|
var err error |
||||
|
for provName, prov := range a.Providers { |
||||
|
user, authed, err = prov.Authenticate(w, r) |
||||
|
if err != nil { |
||||
|
log.Printf("[ERROR] Authenticating with %s: %v", provName, err) |
||||
|
continue |
||||
|
} |
||||
|
if authed { |
||||
|
break |
||||
|
} |
||||
|
} |
||||
|
if !authed { |
||||
|
return caddyhttp.Error(http.StatusUnauthorized, fmt.Errorf("not authenticated")) |
||||
|
} |
||||
|
|
||||
|
repl := r.Context().Value(caddy.ReplacerCtxKey).(caddy.Replacer) |
||||
|
repl.Set("http.handlers.authentication.user.id", user.ID) |
||||
|
|
||||
|
return next.ServeHTTP(w, r) |
||||
|
} |
||||
|
|
||||
|
// Authenticator is a type which can authenticate a request.
|
||||
|
// If a request was not authenticated, it returns false. An
|
||||
|
// error is only returned if authenticating the request fails
|
||||
|
// for a technical reason (not for bad/missing credentials).
|
||||
|
type Authenticator interface { |
||||
|
Authenticate(http.ResponseWriter, *http.Request) (User, bool, error) |
||||
|
} |
||||
|
|
||||
|
// User represents an authenticated user.
|
||||
|
type User struct { |
||||
|
ID string |
||||
|
} |
||||
|
|
||||
|
// Interface guards
|
||||
|
var ( |
||||
|
_ caddy.Provisioner = (*Authentication)(nil) |
||||
|
_ caddyhttp.MiddlewareHandler = (*Authentication)(nil) |
||||
|
) |
@ -0,0 +1,104 @@ |
|||||
|
// Copyright 2015 Matthew Holt and The Caddy Authors
|
||||
|
//
|
||||
|
// Licensed under the Apache License, Version 2.0 (the "License");
|
||||
|
// you may not use this file except in compliance with the License.
|
||||
|
// You may obtain a copy of the License at
|
||||
|
//
|
||||
|
// http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
//
|
||||
|
// Unless required by applicable law or agreed to in writing, software
|
||||
|
// distributed under the License is distributed on an "AS IS" BASIS,
|
||||
|
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
|
// See the License for the specific language governing permissions and
|
||||
|
// limitations under the License.
|
||||
|
|
||||
|
package caddyauth |
||||
|
|
||||
|
import ( |
||||
|
"encoding/base64" |
||||
|
"encoding/json" |
||||
|
|
||||
|
"github.com/caddyserver/caddy/v2/caddyconfig" |
||||
|
"github.com/caddyserver/caddy/v2/caddyconfig/httpcaddyfile" |
||||
|
"github.com/caddyserver/caddy/v2/modules/caddyhttp" |
||||
|
) |
||||
|
|
||||
|
func init() { |
||||
|
httpcaddyfile.RegisterHandlerDirective("basicauth", parseCaddyfile) |
||||
|
} |
||||
|
|
||||
|
// parseCaddyfile sets up the handler from Caddyfile tokens. Syntax:
|
||||
|
//
|
||||
|
// basicauth [<matcher>] [<hash_algorithm>] {
|
||||
|
// <username> <hashed_password_base64> [<salt_base64>]
|
||||
|
// ...
|
||||
|
// }
|
||||
|
//
|
||||
|
// If no hash algorithm is supplied, bcrypt will be assumed.
|
||||
|
func parseCaddyfile(h httpcaddyfile.Helper) (caddyhttp.MiddlewareHandler, error) { |
||||
|
var ba HTTPBasicAuth |
||||
|
|
||||
|
for h.Next() { |
||||
|
var cmp Comparer |
||||
|
args := h.RemainingArgs() |
||||
|
|
||||
|
var hashName string |
||||
|
switch len(args) { |
||||
|
case 0: |
||||
|
hashName = "bcrypt" |
||||
|
case 1: |
||||
|
hashName = args[0] |
||||
|
default: |
||||
|
return nil, h.ArgErr() |
||||
|
} |
||||
|
|
||||
|
switch hashName { |
||||
|
case "bcrypt": |
||||
|
cmp = BcryptHash{} |
||||
|
case "scrypt": |
||||
|
cmp = ScryptHash{} |
||||
|
default: |
||||
|
return nil, h.Errf("unrecognized hash algorithm: %s", hashName) |
||||
|
} |
||||
|
|
||||
|
ba.HashRaw = caddyconfig.JSONModuleObject(cmp, "algorithm", hashName, nil) |
||||
|
|
||||
|
for h.NextBlock(0) { |
||||
|
username := h.Val() |
||||
|
|
||||
|
var b64Pwd, b64Salt string |
||||
|
h.Args(&b64Pwd, &b64Salt) |
||||
|
if h.NextArg() { |
||||
|
return nil, h.ArgErr() |
||||
|
} |
||||
|
|
||||
|
if username == "" || b64Pwd == "" { |
||||
|
return nil, h.Err("username and password cannot be empty or missing") |
||||
|
} |
||||
|
|
||||
|
pwd, err := base64.StdEncoding.DecodeString(b64Pwd) |
||||
|
if err != nil { |
||||
|
return nil, h.Errf("decoding password: %v", err) |
||||
|
} |
||||
|
var salt []byte |
||||
|
if b64Salt != "" { |
||||
|
salt, err = base64.StdEncoding.DecodeString(b64Salt) |
||||
|
if err != nil { |
||||
|
return nil, h.Errf("decoding salt: %v", err) |
||||
|
} |
||||
|
} |
||||
|
|
||||
|
ba.AccountList = append(ba.AccountList, Account{ |
||||
|
Username: username, |
||||
|
Password: pwd, |
||||
|
Salt: salt, |
||||
|
}) |
||||
|
} |
||||
|
} |
||||
|
|
||||
|
return Authentication{ |
||||
|
ProvidersRaw: map[string]json.RawMessage{ |
||||
|
"http_basic": caddyconfig.JSON(ba, nil), |
||||
|
}, |
||||
|
}, nil |
||||
|
} |
@ -0,0 +1,80 @@ |
|||||
|
// Copyright 2015 Matthew Holt and The Caddy Authors
|
||||
|
//
|
||||
|
// Licensed under the Apache License, Version 2.0 (the "License");
|
||||
|
// you may not use this file except in compliance with the License.
|
||||
|
// You may obtain a copy of the License at
|
||||
|
//
|
||||
|
// http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
//
|
||||
|
// Unless required by applicable law or agreed to in writing, software
|
||||
|
// distributed under the License is distributed on an "AS IS" BASIS,
|
||||
|
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
|
// See the License for the specific language governing permissions and
|
||||
|
// limitations under the License.
|
||||
|
|
||||
|
package caddyauth |
||||
|
|
||||
|
import ( |
||||
|
"encoding/base64" |
||||
|
"flag" |
||||
|
"fmt" |
||||
|
|
||||
|
"github.com/caddyserver/caddy/v2" |
||||
|
caddycmd "github.com/caddyserver/caddy/v2/cmd" |
||||
|
"golang.org/x/crypto/bcrypt" |
||||
|
"golang.org/x/crypto/scrypt" |
||||
|
) |
||||
|
|
||||
|
func init() { |
||||
|
caddycmd.RegisterCommand(caddycmd.Command{ |
||||
|
Name: "hash-password", |
||||
|
Func: cmdHashPassword, |
||||
|
Usage: "--plaintext <password> [--salt <string>] [--algorithm <name>]", |
||||
|
Short: "Hashes a password and writes base64", |
||||
|
Long: ` |
||||
|
Convenient way to hash a plaintext password. The resulting |
||||
|
hash is written to stdout as a base64 string. |
||||
|
|
||||
|
--algorithm may be bcrypt or scrypt. If script, the default |
||||
|
parameters are used. |
||||
|
|
||||
|
Use the --salt flag for algorithms which require a salt to |
||||
|
be provided (scrypt). |
||||
|
`, |
||||
|
Flags: func() *flag.FlagSet { |
||||
|
fs := flag.NewFlagSet("hash-password", flag.ExitOnError) |
||||
|
fs.String("algorithm", "bcrypt", "Name of the hash algorithm") |
||||
|
fs.String("plaintext", "", "The plaintext password") |
||||
|
fs.String("salt", "", "The password salt") |
||||
|
return fs |
||||
|
}(), |
||||
|
}) |
||||
|
} |
||||
|
|
||||
|
func cmdHashPassword(fs caddycmd.Flags) (int, error) { |
||||
|
algorithm := fs.String("algorithm") |
||||
|
plaintext := []byte(fs.String("plaintext")) |
||||
|
salt := []byte(fs.String("salt")) |
||||
|
|
||||
|
var hash []byte |
||||
|
var err error |
||||
|
switch algorithm { |
||||
|
case "bcrypt": |
||||
|
hash, err = bcrypt.GenerateFromPassword(plaintext, bcrypt.DefaultCost) |
||||
|
case "scrypt": |
||||
|
def := ScryptHash{} |
||||
|
def.SetDefaults() |
||||
|
hash, err = scrypt.Key(plaintext, salt, def.N, def.R, def.P, def.KeyLength) |
||||
|
default: |
||||
|
return caddy.ExitCodeFailedStartup, fmt.Errorf("unrecognized hash algorithm: %s", algorithm) |
||||
|
} |
||||
|
if err != nil { |
||||
|
return caddy.ExitCodeFailedStartup, err |
||||
|
} |
||||
|
|
||||
|
hashBase64 := base64.StdEncoding.EncodeToString([]byte(hash)) |
||||
|
|
||||
|
fmt.Println(hashBase64) |
||||
|
|
||||
|
return 0, nil |
||||
|
} |
@ -0,0 +1,111 @@ |
|||||
|
// Copyright 2015 Matthew Holt and The Caddy Authors
|
||||
|
//
|
||||
|
// Licensed under the Apache License, Version 2.0 (the "License");
|
||||
|
// you may not use this file except in compliance with the License.
|
||||
|
// You may obtain a copy of the License at
|
||||
|
//
|
||||
|
// http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
//
|
||||
|
// Unless required by applicable law or agreed to in writing, software
|
||||
|
// distributed under the License is distributed on an "AS IS" BASIS,
|
||||
|
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
|
// See the License for the specific language governing permissions and
|
||||
|
// limitations under the License.
|
||||
|
|
||||
|
package caddyauth |
||||
|
|
||||
|
import ( |
||||
|
"github.com/caddyserver/caddy/v2" |
||||
|
"golang.org/x/crypto/bcrypt" |
||||
|
"golang.org/x/crypto/scrypt" |
||||
|
) |
||||
|
|
||||
|
func init() { |
||||
|
caddy.RegisterModule(BcryptHash{}) |
||||
|
caddy.RegisterModule(ScryptHash{}) |
||||
|
} |
||||
|
|
||||
|
// BcryptHash implements the bcrypt hash.
|
||||
|
type BcryptHash struct{} |
||||
|
|
||||
|
// CaddyModule returns the Caddy module information.
|
||||
|
func (BcryptHash) CaddyModule() caddy.ModuleInfo { |
||||
|
return caddy.ModuleInfo{ |
||||
|
Name: "http.handlers.authentication.hashes.bcrypt", |
||||
|
New: func() caddy.Module { return new(BcryptHash) }, |
||||
|
} |
||||
|
} |
||||
|
|
||||
|
// Compare compares passwords.
|
||||
|
func (BcryptHash) Compare(hashed, plaintext, _ []byte) (bool, error) { |
||||
|
err := bcrypt.CompareHashAndPassword(hashed, plaintext) |
||||
|
if err == bcrypt.ErrMismatchedHashAndPassword { |
||||
|
return false, nil |
||||
|
} |
||||
|
if err != nil { |
||||
|
return false, err |
||||
|
} |
||||
|
return true, nil |
||||
|
} |
||||
|
|
||||
|
// ScryptHash implements the scrypt KDF as a hash.
|
||||
|
type ScryptHash struct { |
||||
|
N int `json:"N,omitempty"` |
||||
|
R int `json:"r,omitempty"` |
||||
|
P int `json:"p,omitempty"` |
||||
|
KeyLength int `json:"key_length,omitempty"` |
||||
|
} |
||||
|
|
||||
|
// CaddyModule returns the Caddy module information.
|
||||
|
func (ScryptHash) CaddyModule() caddy.ModuleInfo { |
||||
|
return caddy.ModuleInfo{ |
||||
|
Name: "http.handlers.authentication.hashes.scrypt", |
||||
|
New: func() caddy.Module { return new(ScryptHash) }, |
||||
|
} |
||||
|
} |
||||
|
|
||||
|
// Provision sets up s.
|
||||
|
func (s *ScryptHash) Provision(_ caddy.Context) error { |
||||
|
s.SetDefaults() |
||||
|
return nil |
||||
|
} |
||||
|
|
||||
|
// SetDefaults sets safe default parameters, but does
|
||||
|
// not overwrite existing values. Each default parameter
|
||||
|
// is set independently; it does not check to ensure
|
||||
|
// that r*p < 2^30. The defaults chosen are those as
|
||||
|
// recommended in 2019 by
|
||||
|
// https://godoc.org/golang.org/x/crypto/scrypt.
|
||||
|
func (s *ScryptHash) SetDefaults() { |
||||
|
if s.N == 0 { |
||||
|
s.N = 32768 |
||||
|
} |
||||
|
if s.R == 0 { |
||||
|
s.R = 8 |
||||
|
} |
||||
|
if s.P == 0 { |
||||
|
s.P = 1 |
||||
|
} |
||||
|
if s.KeyLength == 0 { |
||||
|
s.KeyLength = 32 |
||||
|
} |
||||
|
} |
||||
|
|
||||
|
// Compare compares passwords.
|
||||
|
func (s ScryptHash) Compare(hashed, plaintext, salt []byte) (bool, error) { |
||||
|
ourHash, err := scrypt.Key(plaintext, salt, s.N, s.R, s.P, s.KeyLength) |
||||
|
if err != nil { |
||||
|
return false, err |
||||
|
} |
||||
|
if hashesMatch(hashed, ourHash) { |
||||
|
return true, nil |
||||
|
} |
||||
|
return false, nil |
||||
|
} |
||||
|
|
||||
|
// Interface guards
|
||||
|
var ( |
||||
|
_ Comparer = (*BcryptHash)(nil) |
||||
|
_ Comparer = (*ScryptHash)(nil) |
||||
|
_ caddy.Provisioner = (*ScryptHash)(nil) |
||||
|
) |
Loading…
Reference in new issue