WSSE implementation without SALT not working

[sergiu-popa]

I implemented the WSSE token in Symfony 2 using SHA512 algorithm WITH salt. Because bcrypt, without specifying the salt, generates one every time encodes a password, the hash_equals at the end of the AuthenticationProvider won't return TRUE ever.

That's because a client encodes the password without a salt, generating a different hash stored in the database. When comparing ONLY these hashes, the password validates. But when concatenating with nonce, created and encode/decoding base64, the hashed won't match:

$expected = base64_encode(sha1(base64_decode($nonce).$created.$secret, true));

So the salt it should be mentioned in the article.

[javiereguiluz]

@sergiu-popa thanks for this ... but this article is too complex and not really necessary most of the times, so we've decided to remove it entirely. See #8943.

I'm sorry because this was going to be your first contribution to Symfony Docs ... but I'm sure there will be more opportunities to contribute. Thanks!

[sergiu-popa]

@javiereguiluz, is there another article about implementing some type of token authentication for mobile apps? If not, could we leave this online with the details I specified?

I know it’s complex, but it’s well-written and explained... and following it I managed to implement it in Symfony 4. I’m using this authentication between a SF4 app and Android/iOS app.

Thanks