限制laravel中哈希的长度

默认情况下,Laravel哈希使用 password_hash() 与河豚密码器一起使用,生成60个字符的结果。然而,60个字符的结果实际上是28个字符的参数,而结果是32个字符的散列。

前28个字符由4个字符前缀组成( $2y$ )2位数成本( 04 - 31 以及22个字符的salt。如果将前28个字符存储在应用程序中的某个位置(例如 .env 文件),您可以使用它检查您从第三方生成和接收的32个字符的哈希。

这个 密码() 函数是围绕 crypt() 功能,但它动态生成自己的盐。由于Laravel不提供手动提供盐的方法,因此您将无法使用 Hash::make() 方法;您需要使用 密码() 方法直接,将正确的数据传递给您的静态盐与河豚密码一起触发。生成的结果仍然与 password_verify() 尽管如此,您仍然可以使用 Hash::check() 验证接收到的哈希(或只使用 密码验证( 直接)。

下面是一个更有用的代码和注释说明。

// This tells crypt() to use the BLOWFISH cypher
$prefix = '$2y$';

// This tells crypt() the number of rounds for the BLOWFISH algorithm to use.
// The higher the number, the longer it takes to generate a hash (good).
// Value must be two digits and between 04 and 31. 10 is default.
$cost = '10';

// This is the 22 character salt (including start and end dollar signs). This is
// the value normally dynamically generated by password_hash(), but you
// are storing a static value in your application.
$salt = '$thisisahardcodedsalt$';

// Concat the three parameters to generate the full 28 character BLOWFISH
// prefix. Instead of using the hardcoded variables above, you would
// probably just get the value out of the config (set by .env file).
$blowfishPrefix = $prefix.$cost.$salt;

// I don't know where your password is coming from, but this is the password
// that you were planning on using for your Hash::make() and Hash::check()
// calls.
$password = 'This is your password.';

// Hash the password to get your 60 character BLOWFISH cipher result.
$hash = crypt($password, $blowfishPrefix);

// The real hash is the last 32 characters. This is the value you pass to your
// third party service.
$hashToThirdParty = substr($hash, -32);

// Now we've generated a hash and sent it to the third party. Now we wait.

// ... at some point, the third party sends the hash back to you.
$hashFromThirdParty = $hashToThirdParty;

// Add your stored BLOWFISH prefix to the hash received from the third party,
// and pass the result into Hash::check() (along with your password).
$verified = Hash::check($password, $blowfishPrefix.$hashFromThirdParty);

// Since we're not using Hash::make() to generate the password, you may not care
// about using Hash::check() to check it. You can just use the underlying
// password_verify() function at this point, if you want.
$altVerified = password_verify($password, $blowfishPrefix.$hashFromThirdParty);

PHP函数资源:
password_hash()
crypt()
password_verify()

Laravel代码资源:
Hash::make() for the bcrypt hasher
Hash::check() for the bcrypt hasher