I managed to fix the problem with the hashed password being incorrect, however at a cost. To fix it i had to store the salt used to hash the password originally. Then when the user attempts to login in the hash and salt and retrieved for that user if a correct username is supplied, otherwise it automatically returns failed(return false;) with no indication as to the reason of the failure for security. I used the retrieved salt against the user input password to regenerate the hash. If both hashes match then it reports a successful login(return true;), otherwise it returns false. Is it safe to store the user salts in the database or is it a security risk? Any assistance would be greatly appreciated.
Sincerely,
Aleeious
Storing Salt in Database
Re: Storing Salt in Database
I've seen that done some places, but I'm not sure it's the best security-wise.
What I normally do is generate a salt in a config file somewhere that I "include_once" in all my other PHP scripts. Then that is still accessible by all the scripts that need it, but it's more secure than having it in your database table.
Just remember to never change your salt once your game starts or old passwords won't work.
One thing you could do is generate a salt from some combination of the username and email address or something, then use that to salt the password. Something like '$salt=md5($username.$email) ' or something similar. If they ever change their email address, generate a new salt and re-save their password.
That way your salt would be stored with the user information and could be recomputed as needed, but it's not explicitly like saying "Here is my salt!"
What I normally do is generate a salt in a config file somewhere that I "include_once" in all my other PHP scripts. Then that is still accessible by all the scripts that need it, but it's more secure than having it in your database table.
Just remember to never change your salt once your game starts or old passwords won't work.
One thing you could do is generate a salt from some combination of the username and email address or something, then use that to salt the password. Something like '$salt=md5($username.$email) ' or something similar. If they ever change their email address, generate a new salt and re-save their password.
That way your salt would be stored with the user information and could be recomputed as needed, but it's not explicitly like saying "Here is my salt!"