CODEWITHSUNDEEP
ruby-on-railssalt-cryptographybcrypt
joanwolk
joanwolk

Reputation: 1105

Are bcrypt salts accessible separately?

When using has_secure_password in Rails 3.1, bcrypt randomly generates a salt for each user's password. Based on this response, I understand the salt is stored as part of the password hash. Is there a method or attribute available to access that salt separately, for example to use in writing secure cookies?

Upvotes: 10

Views: 4621

Answers (1)

Jesse Wolgamott
Jesse Wolgamott

Reputation: 40277

You'll be able to get the salt and checksum if you need it. 

gem install bcrypt-ruby
irb
require 'bcrypt'

hash = BCrypt::Password.create 'superpass'
=> "$2a$10$DtjuZD6nJtrBRLEySlSVm.bJyBMhEhVRAeiVk/GjmQdBNf7WhmDWi"
hash.salt
=> "$2a$10$DtjuZD6nJtrBRLEySlSVm."
hash.checksum
"bJyBMhEhVRAeiVk/GjmQdBNf7WhmDWi"
hash == "starbucks"
=> false
hash == "superpass"
=> true

Your salt and checksum will vary.

More info: https://github.com/codahale/bcrypt-ruby

Upvotes: 15

Related Questions