[Catalyst] Storing the hash of the session token with
	C::P::Session::Store::File
    Octavian Rasnita 
    orasnita at gmail.com
       
    Sun Nov 18 13:03:47 GMT 2012
    
    
  
Hi,
I read a good suggestion:
"And DO NOT STORE THE PERSISTENT LOGIN COOKIE (TOKEN) IN YOUR DATABASE, ONLY 
A HASH OF IT! The login token is Password Equivalent, so if an attacker got 
his hands on your database, he/she could use the tokens to log in to any 
account, just as if they were cleartext login-password combinations. 
Therefore, use strong salted hashing (bcrypt / phpass) when storing 
persistent login tokens."
I've seen that C::P::Session::Store::File stores the token of the session on 
the server, and not only its hash.
Is there a way to configure this plugin to store just the hash of the token 
on the server?
--Octavian
    
    
More information about the Catalyst
mailing list