Search code examples
javascriptphppassword-protectionpassword-encryptionpassword-hash

Password_hash() need of pre-hashing before submit?

I'm using the PHP 5.5+ password_hash() function to hash my passwords before storage in the database. So far so good.

What I am a bit uncertain of is the need of pre-hashing the password that it sent from the form to my PHP script.

Now the form submit procedure is (in short terms) done like this:

  1. HTML file which contains the form calls the controller script in form method=".." ->
  2. Controller script recieves the call and picks the correct function ->
  3. function execution and storage to database.

So basically the call is sent through three files from submit to storage.

I am thinking that somewhere along the line the data could be hijacked and seen in plain view since the hashing is done in the third and final file.

Should I be worried and somehow hash the password with some JavaScript during the initial submission of the form or is it safe? The final site will most likely use an SSL certificate but still I'm not 100% sure if I am safe or not.

Solution

  • Your concerns about hijacking the password between controllers are superfluous :

    For an attacker to hijack the password while it's passed between different controllers it would mean the attacker has to be able to read the memory of the PHP process, which would require root privileges. If the attacker has root privileges, you have a bigger problem and your solution won't save you because that same attacker can also modify the PHP files to remove your "protection".

    As for hijacking the password while it's flying through the Internet, the only solution is to use HTTPS - whatever Javascript cryptography/hashing you would do is pointless since an eavesdropper is also able to alter the page while it's being transmitted and serve a modified version of it without the additional "security" you added; there are many questions about trying to secure a login form without HTTPS on Security.SE, check them out :