Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

"Encrypted password" is actually "Hash" of the password. Does it need to be renamed? #5654

Open
Ashwintrn opened this issue Nov 24, 2023 · 1 comment

Comments

@Ashwintrn
Copy link

Currently, the column designated for the hashed value of the password is named "encrypted_password". While I understand the historical context, I've noticed that this term could potentially be a bit misleading for some users.
For clarity and user experience, It would be helpful to rename this column to something like "password_hash" or another relatable name. If suitable/possible we can just give an alias_name in the codebase. This adjustment could help avoid confusion and create a more intuitive environment for users interacting with the database directly. Much Appreciate your work. TIA.

@rnestler
Copy link

I also was confused / amused by the encrypted_password name. Note that in the code it mentions that it is named like this for legacy reasons:

# Generates a hashed password based on the given value.
# For legacy reasons, we use `encrypted_password` to store
# the hashed password.
def password=(new_password)
@password = new_password
self.encrypted_password = password_digest(@password) if @password.present?
end

How would one implement a rename of the field in a backwards compatible manner? I imagine something like this:

  1. Add password_hash alias to database_authenticatable: This allows to use password_hash in most places in the code, without needing to change anything else.
  2. Rename the encrypted_password field in the DB to password_hash, the generated migrations, providing an update path when upgrading the gem and add a deprecated alias encrypted_password to the new password_hash

Or maybe allow to use either password_hash or encrypted_password as the DB field name as an intermediate step?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Development

No branches or pull requests

2 participants