1

I know it's generally said that storing user credentials in plaintext is a horrible idea. I'm in the middle of implementing Basic Auth over SSL and was wondering what I should do with the user credentials once they're decrypted. Once I decrypt from the wire, I need to make sure the credentials match what's stored in the db. What's a secure way to get this done?

Improve this question
1
  • It's actually covered by the answer below, but I'll reiterate: you should never store a password in a way that enables anyone (including yourself) to figure out the original (plaintext) password.
    – Joel
    Commented Apr 12, 2013 at 16:44

1 Answer 1

Reset to default
2

You need to store a hashed version of the password in your database. Upon receiving the password from the wire, you recompute the hash and check that it matches the stored version.

This shall be done this care. This answer explains it all.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .