Comments on: Password Hashing in CFML

By: Christophe

Christophe — Mon, 21 Nov 2022 07:38:45 +0000

Hi,

Thank you for this very very interesting post!

Kind regards,

Christophe

By: Andrew Dixon

Andrew Dixon — Tue, 25 Oct 2022 09:53:26 +0000

In reply to Heru.

There is no need to include the “pepper” in the checkPassword function as it uses the generateHash function to generate the hash again and compare it to the stored hash. so the pepper is added automatically.

Also, if you are doing something new and using Lucee, then you probably want to use the Argon2 algorithm, see https://www.andrewdixon.co.uk/2020/09/19/using-argon2-in-lucee-cfml/

By: Heru

Heru — Mon, 17 Oct 2022 21:39:53 +0000

Hi Andrew, I just tried using your code to hash a password for my test application. It’s great that you have your codes here for me to learn BUT I noticed on your generateHash function you added application.pepper which is great BUT on the checkPassword function, you did not include the application.pepper value. So when I used your code to test mine (without the pepper) I got a NO instead of Yes in the value returned by the check password function.
How should I include the application.pepper in the checkPassword function, Thank you

By: Andrew Dixon

Andrew Dixon — Wed, 29 Jul 2020 11:13:49 +0000

In reply to Christian. Thanks Christian

By: Christian

Christian — Wed, 29 Jul 2020 07:07:32 +0000

Great, helped me a lot. Thanks for that!

And I find your final code example quite elegant.

By: Andrew Dixon

Andrew Dixon — Tue, 09 Jun 2020 17:39:29 +0000

In reply to Hugh Rainey. Thanks Hugh

By: Hugh Rainey

Hugh Rainey — Tue, 09 Jun 2020 16:07:41 +0000

Well written and explained.