Sign in Register
Copied to clipboard

Flag this post as spam?

This post will be reported to the moderators as potential spam to be looked at


  • aman 13 posts 123 karma points
    Jan 10, 2017 @ 09:30
    aman
    0

    Default password encryption in Umbraco 7 and overriding it

    What is the default password encryption in Umbraco 7? Is there possibility to override it? For example if U7 uses SHA1, which is not safe, how can I migrate to SHA256?

    Copy Link
  • Jeffrey Schoemaker 408 posts 2138 karma points MVP 8x c-trib
    Jan 12, 2017 @ 15:36
    Jeffrey Schoemaker
    100

    Hi Aman,

    take a look at the page https://umbraco.com/security. You should (after install) set "legacyEncoding" to "false" in your web.config and after that the passwords are hashed HMAC-SHA256 and a 128bit-salt.

    Regards, Jeffrey

    Copy Link
  • aman 13 posts 123 karma points
    Jan 19, 2017 @ 12:28
    aman
    0

    Thank you!

    After switching to new hash algorithm now I cannot log in to backoffice locally. Seems that courier users are not created in umbraco. Is there workaround to avoid this issue?

    Changes I have implemented:

    • useLegacyEncoding = false
    • hashAlgorithmType = "HMACSHA256"
    Copy Link

  • This forum is in read-only mode while we transition to the new forum.

    You can continue this topic on the new forum by tapping the "Continue discussion" link below.

Please Sign in or register to post replies