{"id":590,"date":"2014-01-09T17:22:16","date_gmt":"2014-01-09T17:22:16","guid":{"rendered":"http:\/\/thomas.w-p.me.uk\/blog\/?p=590"},"modified":"2014-01-09T17:22:55","modified_gmt":"2014-01-09T17:22:55","slug":"cakephp-acl-with-bcryptblowfish","status":"publish","type":"post","link":"https:\/\/thomas.w-p.me.uk\/blog\/2014\/01\/cakephp-acl-with-bcryptblowfish\/","title":{"rendered":"CakePHP ACL with bcrypt\/blowfish"},"content":{"rendered":"

\"\"I have been playing around with cakePHP, trying to get the authentication to play nicely with bcrypt.\u00a0 bcrypt (blowfish crypt?) is a way of encrypting data which includes its own random salt in the hash.\u00a0 So you only need one field for the password but it is pretty secure.<\/p>\n

After a lot of pain, it turns out that moving from the working basic ACL security (set up using the tutorial<\/a>) to bcrypt is pretty easy.\u00a0 Two files to change!\u00a0 But it took me hours to work out because of silly errors like not having the password field in the database long enough for the hash (they appear to be 250 characters long).<\/p>\n

I suspect I don’t need the ‘username’ => ‘username’ etc. but after a long effort to get it working I don’t really want to break it again.<\/p>\n

<?php\r\n\/**\r\n * Application level Controller\r\n *\r\n * This file is application-wide controller file. You can put all\r\n * application-wide controller-related methods here.\r\n *\r\n * CakePHP(tm) : Rapid Development Framework (http:\/\/cakephp.org)\r\n * Copyright (c) Cake Software Foundation, Inc. (http:\/\/cakefoundation.org)\r\n *\r\n * Licensed under The MIT License\r\n * For full copyright and license information, please see the LICENSE.txt\r\n * Redistributions of files must retain the above copyright notice.\r\n *\r\n * @copyright     Copyright (c) Cake Software Foundation, Inc. (http:\/\/cakefoundation.org)\r\n * @link          http:\/\/cakephp.org CakePHP(tm) Project\r\n * @package       app.Controller\r\n * @since         CakePHP(tm) v 0.2.9\r\n * @license       http:\/\/www.opensource.org\/licenses\/mit-license.php MIT License\r\n *\/\r\n\r\nApp::uses('Controller', 'Controller');\r\n\r\n\/**\r\n * Application Controller\r\n *\r\n * Add your application-wide methods in the class below, your controllers\r\n * will inherit them.\r\n *\r\n * @package\t\tapp.Controller\r\n * @link\t\thttp:\/\/book.cakephp.org\/2.0\/en\/controllers.html#the-app-controller\r\n *\/\r\nclass AppController extends Controller {\r\n\r\n    public $components = array(\r\n        'Acl',\r\n        'Auth' => array(\r\n            'authorize' => array(\r\n                'Actions' => array('actionPath' => 'controllers')\r\n            ),\r\n\t\t\t'authenticate' => array(\r\n\t\t\t\t'Blowfish' => array(\r\n\t\t\t\t\t'fields' => array(\r\n\t\t\t\t\t\t'username' => 'username',\r\n\t\t\t\t\t\t'password' => 'password'\r\n\t\t\t\t\t),\r\n\t\t\t\t\t'userModel' => 'User',\r\n\t\t\t\t\t'scope' => array()\r\n\t\t\t\t)\r\n\t\t\t)\r\n        ),\r\n        'Session'\r\n    );\r\n\r\n    public $helpers = array('Html', 'Form', 'Session');\r\n\r\n    public function beforeFilter() {\r\n\r\n\t\t\/\/ Use bcrypt for hashes\r\n\t\tSecurity::setHash('blowfish');\r\n\r\n        \/\/Configure AuthComponent\r\n        $this->Auth->loginAction = array(\r\n          'controller' => 'users',\r\n          'action' => 'login'\r\n        );\r\n        $this->Auth->logoutRedirect = array(\r\n          'controller' => 'users',\r\n          'action' => 'login'\r\n        );\r\n        $this->Auth->loginRedirect = array(\r\n          'controller' => 'posts',\r\n          'action' => 'add'\r\n        );\r\n\r\n\t\t$this->Auth->allow('display');\r\n    }\r\n}<\/pre>\n
And change the beforeSave function in Model\/User.php<\/p>\n
\t\/\/ for acl with blowfish\/bcrypt\r\n    public function beforeSave($options = array()) {\r\n\r\n\t\t\/\/ hash the password\r\n        $this->data['User']['password'] = Security::hash($this->data['User']['password']);\t\r\n\r\n        return true;\r\n\r\n    }<\/pre>\n
Of course, enabling this breaks the working logins and you have to edit them to get the new hashes.\u00a0 You’ll be locked out if you don’t put $this->Auth->allow(); in the beforeFilter() function of the UsersController.php whilst you do it.<\/p>\n
 <\/p>\n","protected":false},"excerpt":{"rendered":"
I have been playing around with cakePHP, trying to get the authentication to play nicely with bcrypt.\u00a0 bcrypt (blowfish crypt?) is a way of encrypting data which includes its own random salt in the hash.\u00a0 So you only need one field for the password but it is pretty secure. After a lot of pain, it … Continue reading CakePHP ACL with bcrypt\/blowfish<\/span> →<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[27],"tags":[67],"class_list":["post-590","post","type-post","status-publish","format-standard","hentry","category-geekiness","tag-cakephp"],"_links":{"self":[{"href":"https:\/\/thomas.w-p.me.uk\/blog\/wp-json\/wp\/v2\/posts\/590","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/thomas.w-p.me.uk\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/thomas.w-p.me.uk\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/thomas.w-p.me.uk\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/thomas.w-p.me.uk\/blog\/wp-json\/wp\/v2\/comments?post=590"}],"version-history":[{"count":8,"href":"https:\/\/thomas.w-p.me.uk\/blog\/wp-json\/wp\/v2\/posts\/590\/revisions"}],"predecessor-version":[{"id":598,"href":"https:\/\/thomas.w-p.me.uk\/blog\/wp-json\/wp\/v2\/posts\/590\/revisions\/598"}],"wp:attachment":[{"href":"https:\/\/thomas.w-p.me.uk\/blog\/wp-json\/wp\/v2\/media?parent=590"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/thomas.w-p.me.uk\/blog\/wp-json\/wp\/v2\/categories?post=590"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/thomas.w-p.me.uk\/blog\/wp-json\/wp\/v2\/tags?post=590"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}