[CASSANDRA-13626] Check hashed password matches expected bcrypt hash format before checking

• Type: Bug
• Status: Resolved
• Priority: Low
• Resolution: Fixed
• Fix Version/s: 3.0.15, 3.11.1, 4.0-alpha1, 4.0
• Component/s: Feature/Authorization
• Severity: Low
• Assignee: Jeff Jirsa
• Reporter: Jeff Jirsa

Authors

Jeff Jirsa

Reviewers

Sam Tunnicliffe

• Created: 20/Jun/17 23:47
• Updated: 15/May/20 08:04
• Resolved: 31/Aug/17 05:06

Description

We use Bcrypt.checkpw in the auth subsystem, but do a reasonably poor job of guaranteeing that the hashed password we send to it is really a hashed password, and checkpw does an even worse job of failing nicely. We should at least sanity check the hash complies with the expected format prior to validating.