Authentication with CakePHP 2.4 only with sha1? - authentication

Question

I got some troubles with the authentication in CakePHP 2.4. I baked a simple App to create a login. I did everything like in the book (Auth and Tutorial). But only sha1 worked. But not sha256 or md5. After searching and testing I came to a solution where I had to change the example code in the book and now it works. But I think, this is not the proper solution.
I did the following in the AppController:
App::uses('Controller', 'Controller');
class AppController extends Controller {
public $components = array(
'Session',
'Auth' => array(
'authenticate' => array(
'Form' => array(
'passwordHasher' => array(
'className' => 'Simple',
'hashType' => 'sha256'
)
)
)
)
);
}
I tested this with md5, sha1 and sha256. No problem. Login works if the passwords are hashed appropriately.
But I noticed, that adding a user only works with sha1, because this is the default hash.
My User Models beforeSafe function was this (from the book):
App::uses('SimplePasswordHasher', 'Controller/Component/Auth');
class User extends AppModel {
public function beforeSave($options = array()) {
if (isset($this->data[$this->alias]['password'])) {
$passwordHasher = new SimplePasswordHasher();
$this->data[$this->alias]['password'] = $passwordHasher->hash(
$this->data[$this->alias]['password']
);
}
return true;
}
}
I thought, that the setting in the AppController is enough, to change the SimplePasswordHasher in this area too. But as it seems, it's not enough. So I changed it to this:
$this->data[$this->alias]['password'] = $passwordHasher->hash(
$this->data[$this->alias]['password']
);
to this
$this->data[$this->alias]['password'] = Security::hash(
$this->data[$this->alias]['password'],
'sha256',
true
);
Now everything works like a charm. But my questions:
1) I'm right, that this is necessary or is my code something else wrong?
2) As I know is $xxx->zzz only for Controllers and xxx::zzz() for everywhere and, right?
3) Why do I have to say the Security hash, that it should hash the string with sha256 again, when I said that already in the AppController in general?

Answer 1

1. As far as I know, your approach is right. Might exist a cleaner way, but I am using bcrypt, and the Cookbook says to do something very similar.
2. You can think like you said for a simple explanation. Basically -> is the object-operator, to deal with objects e.g. $this->doEverything. And :: is the scope-resolution-operator which is used to find Class static property or method. And normally you can run this everywhere, e.g., Security::hash().
3. Take a look here, you should probably change your AppController to:
'passwordHasher' => array(
'className' => 'Simple',
'hashType' => 'sha256'
)
to fit on the recomendations. Altough I've tryed this, and didn't changed the SimplePasswordHasher to SHA256. It is a reference that cake seems to ignore somehow. But that is the Simple hasher, intended to simple thing, so you are supposed to do your own approach, or one that fits better to your needs.