Cakephp & user email confirmation

Question

i'm new to php and cakephp, i was following the Simple Authentication and Authorization Application tutorial from cakephp (http://book.cakephp.org/2.0/en/tutorials-and-examples/blog-auth-example/auth.html). All seem to working good.

I'm add a email confirmation to activate the account when a user subscribe. In the tutorial the password is using the blowfishpassword hasher. And i'm using it as a token in the link for the confirmation.

but i can't seem to be able to compare the link token with the password in the database...

$passwordHasher = new BlowfishPasswordHasher();
            $motdepasse = $this->data['Utilisateur']['mot_passe'] = $passwordHasher->hash(
                $this->data['Utilisateur']['mot_passe']
            );
            $link = array('controller'=>'utilisateurs','action'=>'activate',$this->Utilisateur->id
                  .'-'. $motdepasse);


public function activate($token) {
  $token = explode('-',$token);
  $user = $this->Utilisateur->find('first',array(
    'conditions' => array('id' => $token[0],'Utilisateur.mot_passe' => Security::hash($token[1], 'blowfish', 'Utilisateur.mot_passe'))
  ));
  debug($user);
  debug($token[1]);
  die();

}

Can you help me? thanks guys!

Wince you're doing it manually, can you check what the hashed version of each is, and see if they're actually different? — Dave

ndm ndm · Accepted Answer · 2014-09-21T15:20:20

First of all you shouldn't send the password hash around, no matter how safe the hash possibly might be, confirmation tokens should be generated separately! Simply store it in an extra column or in a separate table.

That being said, in your activate() method you are hashing the hash again, which, in case the hash would actually be generated, would cause the comparison to fail. However the script won't genereate a hash, as you are using an invalid salt value which should result in the following warning:

Invalid salt: Utilisateur.mot_passe for blowfish Please visit http://www.php.net/crypt and read the appropriate section for building blowfish salts.

and Security::hash() will return an empty string. If you don't get such a message, then you'll need to enable the debug mode.

I'd suggest to get familiar with PHP, CakePHP, hashing and stuff first before you try to implement security related functionality!

You may want to check out https://github.com/CakeDC/users, it supports email verification and lot more out of the box.

Cakephp & user email confirmation

1 Answers