开发安全指南：如何安全地储存用户密码

$hash = password_hash($userPassword, PASSWORD_DEFAULT);

$hash = password_hash($userPassword, PASSWORD_DEFAULT, ['cost' => 12]);

if (password_verify($userPassword, $hash)) {    // Login successful.    if (password_needs_rehash($userPassword, PASSWORD_DEFAULT, ['cost' => 12])) {        // Recalculate a new password_hash() and overwrite the one we stored previously    }}

#If you don't have PECL installed, get that first.pecl install scryptecho "extension=scrypt.so" > /etc/php5/mods-available/scrypt.iniphp5enmod scrypt

# Hashing$hash = \Password::hash($userProvidedPassword);# Validationif (\Password::check($userProvidedPassword, $hash)) {    // Logged in successfully.}

String hash = BCrypt.hashpw(userProvidedPassword, BCrypt.gensalt());

if (BCrypt.checkpw(userProvidedPassword, hash)) {    // Login successful.}

# Calculating a hashint N = 16384;int r = 8;int p = 1;String hashed = SCryptUtil.scrypt(passwd, N, r, p);# Validating a hashif (SCryptUtil.check(passwd, hashed)) {    // Login successful}

// Calculating a hashstring hash = BCrypt.HashPassword(usersPassword, BCrypt.GenerateSalt());// Validating a hashif (BCrypt.Verify(usersPassword, hash)) {    // Login successful}

// This is necessary:ScryptEncoder encoder = new ScryptEncoder();// Calculating a hashSecureString hashedPassword = encoder.Encode(usersPassword);// Validating a hashif (encoder.Compare(usersPassword, hashedPassword)) {    // Login successful}

require "bcrypt"# Calculating a hashmy_password = BCrypt::Password.create(usersPassword)# Validating a hashif my_password == usersPassword  # Login successful

require "scrypt"# Calculating a hashpassword = SCrypt::Password.create(usersPassword)# Validating a hashif password == usersPassword  # Login successful

import bcryptimport hmac# Calculating a hashpassword = b"correct horse battery staple"hashed = bcrypt.hashpw(password, bcrypt.gensalt())# Validating a hash (don't use ==)if (hmac.compare_digest(bcrypt.hashpw(password, hashed), hashed)):    # Login successful

from passlib.hash import bcrypt# Calculating a hashhash = bcrypt.encrypt(usersPassword, rounds=12)# Validating a hashif bcrypt.verify(usersPassword, hash):    # Login successful

var Promise = require("bluebird");var bcrypt = Promise.promisifyAll(require("bcrypt"));function addBcryptType(err) {    // Compensate for `bcrypt` not using identifiable error types    err.type = "bcryptError";    throw err;}// Calculating a hash:Promise.try(function() {    return bcrypt.hashAsync(usersPassword, 10).catch(addBcryptType);}).then(function(hash) {    // Store hash in your password DB.});// Validating a hash:// Load hash from your password DB.Promise.try(function() {    return bcrypt.compareAsync(usersPassword, hash).catch(addBcryptType);}).then(function(valid) {    if (valid) {        // Login successful    } else {        // Login wrong    }});// You would handle errors something like this, but only at the top-most point where it makes sense to do so:Promise.try(function() {    // Generate or compare a hash here}).then(function(result) {    // ... some other stuff ...}).catch({type: "bcryptError"}, function(err) {    // Something went wrong with bcrypt});

var Promise = require("bluebird");var scrypt = require("scrypt-for-humans");// Calculating a hash:Promise.try(function() {  return scrypt.hash(usersPassword);}).then(function(hash) {  // Store hash for long term use});// Validating a hash:Promise.try(function() {  return scrypt.verifyHash(usersPassword, hash);}).then(function() {  // Login successful}).catch(scrypt.PasswordError, function(err) {  // Login failed});