1

I know it's generally said that storing user credentials in plaintext is a horrible idea. I'm in the middle of implementing Basic Auth over SSL and was wondering what I should do with the user credentials once they're decrypted. Once I decrypt from the wire, I need to make sure the credentials match what's stored in the db. What's a secure way to get this done?

1
  • It's actually covered by the answer below, but I'll reiterate: you should never store a password in a way that enables anyone (including yourself) to figure out the original (plaintext) password.
    – Joel L
    Apr 12, 2013 at 16:44

1 Answer 1

2

You need to store a hashed version of the password in your database. Upon receiving the password from the wire, you recompute the hash and check that it matches the stored version.

This shall be done this care. This answer explains it all.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.