wwUserSecurity.cPasswordEncryptionKey

Encryption key string that's used to hash the password stored in the usersecurity file's password field.

The value is hashed when a user is saved via the SaveUser(). Hashed passwords end in a postfix of ~~.

Set this key on class Startup

This key has to be set before any methods that lookup or save the user, as the key is used to construct the password hash to compare against the stored database value, which is stored with the computed hash.
loSecurity = CREATEOBJECT("wwUserSecurity")
loSecurity.cPasswordEncryptionKey = "superSeekrit!123"

*** later: Now this works (no key will always fail)
IF !loSecurity.Authenticate("username","password")
   wait window "Authentication failed"
ENDIF
You can also use the Init(lcPasswordKey) initializer (v8.6+):
loSecurity = CREATEOBJECT("wwUserSecurity", "superSeekrit!123")

o.wwUserSecurity.cPasswordEncryptionKey

Default Value

String value that is used to encode passwords for hashing. The value is further hashed and salted before writing the hashed password into the table.

Remarks

Key Consistency Required!

This key has to be consistent across your applications both when passwords are created and looked up as passwords are stored and retrieve in the database.

If the key changes or is lost, existing hashes cannot be resolved and all password lookups are unrecoverable and will fail.

Example

loSecurity = CREATEOBJECT("wwUserSecurity")

loSecurity.cPasswordEncryptionKey = "seekrit"

*** Ideallly store in config file or Environment Var etc.
* loSecurity.cPasswordEncryptionKey = goServer.oConfig.cPasswordEncryptionKey 

*** Create a new User
loSecurity.NewUser()

loUser = loSecurity.oUser
loUser.Username = "test2@west-wind.com"
loUser.Password = "test2"
loUser.FullName = "Test2 User"

lcOld = loSecurity.oUser.password

*** Saves user with encrypted password
llResult = loSecurity.SaveUser()

lcnew = loSecurity.oUser.password  && Encrypted with ~~

*** Try to authenticate against encrypted DB data
llResult = loSecurity.Authenticate("test2@west-wind.com","test2")
this.AssertTrue(llResult,"Authentication should work")


loSecurity.DeleteUser(loSecurity.oUser.Pk)

wwUserSecurity.cPasswordEncryptionKey

Set this key on class Startup

Default Value

Remarks

Key Consistency Required!

Example

See also