Sign in Register
Go to solution
Copied to clipboard

Flag this post as spam?

This post will be reported to the moderators as potential spam to be looked at


  • aman 13 posts 123 karma points
    Jan 10, 2017 @ 09:30
    aman
    0

    Default password encryption in Umbraco 7 and overriding it

    What is the default password encryption in Umbraco 7? Is there possibility to override it? For example if U7 uses SHA1, which is not safe, how can I migrate to SHA256?

    Copy Link
  • Jeffrey Schoemaker 408 posts 2138 karma points MVP 8x c-trib
    Jan 12, 2017 @ 15:36
    Jeffrey Schoemaker
    100

    Hi Aman,

    take a look at the page https://umbraco.com/security. You should (after install) set "legacyEncoding" to "false" in your web.config and after that the passwords are hashed HMAC-SHA256 and a 128bit-salt.

    Regards, Jeffrey

    Copy Link
  • aman 13 posts 123 karma points
    Jan 19, 2017 @ 12:28
    aman
    0

    Thank you!

    After switching to new hash algorithm now I cannot log in to backoffice locally. Seems that courier users are not created in umbraco. Is there workaround to avoid this issue?

    Changes I have implemented:

    • useLegacyEncoding = false
    • hashAlgorithmType = "HMACSHA256"
    Copy Link
Please Sign in or register to post replies

Write your reply to:

Draft