Admin Password Hashing - Revision history

SarahK at 17:10, 18 April 2022

2022-04-18T17:10:45Z

SarahK: /* Hash Schema */

2020-05-27T20:32:42Z

‎Hash Schema

SarahK: /* Hash Schema */

2020-05-27T20:32:24Z

‎Hash Schema

SarahK at 20:31, 27 May 2020

2020-05-27T20:31:03Z

Matt at 08:57, 10 April 2017

2017-04-10T08:57:03Z

Matt: /* Public Documentation for Developers */

2016-05-10T13:40:39Z

‎Public Documentation for Developers

Chance: /* Public Documentation for Developers */

2016-02-24T13:55:14Z

‎Public Documentation for Developers

Matt: /* Public Documentation for Developers */

2014-08-26T14:58:18Z

‎Public Documentation for Developers

Matt: Created page with "== Summary == Prior to v5.3.9 (5.3.9-release.1), WHMCS admin passwords used a hashing mechanism that did not leverage the more secure algorithms and routines afforded by most..."

2014-08-26T13:16:37Z

Created page with "== Summary == Prior to v5.3.9 (5.3.9-release.1), WHMCS admin passwords used a hashing mechanism that did not leverage the more secure algorithms and routines afforded by most..."

New page

== Summary ==

Prior to v5.3.9 (5.3.9-release.1), WHMCS admin passwords used a hashing mechanism that did not leverage the more secure algorithms and routines afforded by most web server environments of today.

If you update a previous installation to 5.3.9, each admin user will have their password automatically rehashed on their next successful login post upgrading. The rehash will occur for either an API authentication or an Admin Area authentication. The WHMCS admin(s) does not need to do anything in order to benefit from this low-level change in the product.

If you are performing a fresh install of WHMCS 5.3.9 (or beyond), your admin passwords will simply be hashed with the latest cryptographically secure mechanism available to your web server environment from the start.

== What You Need To Know ==
* This security refinement occurs at a low-level and will typically go unobserved in a standard WHMCS installation.
* Only 3rd-Party Integration Developers that read/write admin authentication details directly from the database will be affected by this change. The specifics of what they’re doing in their code will determine the complexity of change required to make their integration functional again.
* Password hashes are only updated upon successful login; it is only then that the application has the raw password and is able to establish a new hash. Because the admin password are stored as one-way hashes, there is no way to perform a batch operation.

== Public Documentation for Developers ==
Below is the '''''minimum''''' amount of code; it is far from adequate, assumes a lot, but demos the relevant class and methods.

A more thorough example script can be found here [[Admin First Factor Verification Demo]]

<source lang="php">
<?php
$authAdmin = new WHMCS_Auth();
if ($authAdmin->getInfobyUsername($username)
&& $authAdmin->comparePassword($password)
) {
$isValid = true;
} else {
$isValid = false;
}
</source>

This is valid for WHMCS versions 5.3.0 and later.

== Hash Schema ==
WHMCS 5.3.9 introduces application-level support and usage of two hash algorithms using cryptographically secure hashing routines.

Both the Bcrypt and SHA256-HMAC algorithms and hashing routines are supported. If the PHP version of the web server is 5.3.7 or greater, then Bcrypt will be used. Otherwise, if the web server is using a version of PHP that is less than 5.3.7, SHA256-HMAC will be used.

@@ Line 1: / Line 1: @@
-== Summary ==
+When you upgrade to WHMCS 5.3.10 or later, the system will rehash each admin user's password automatically on the next successful login. The rehash will occur for either API authentication or an [[Admin Area]] authentication.
-When you upgrade to WHMCS 5.3.10 or later, the system will rehash each admin user's password automatically on the next successful login. The rehash will occur for either API authentication or an Admin Area authentication. WHMCS admins don't need to do anything to benefit from this low-level change in the product.
+If you're performing a new installation of WHMCS 5.3.9 or later, the system will always hash your admin passwords with the latest cryptographically-secure mechanism available.
 == What You Need To Know ==
@@ Line 36: / Line 34: @@
 <div class="docs-alert-warning">
 <span class="title">About this example</span><br />
-The above code sample is compatible with WHMCS Version 6.0 and later
+The above code sample is compatible with WHMCS 6.0 and later.
 </div>

@@ Line 40: / Line 40: @@
 == Hash Schema ==
-[Updating|WHMCS 5.3.9] introduced application-level support and the Bcrypt and SHA256-HMAC hash algorithms using cryptographically secure hashing routines.
+[[Updating|WHMCS 5.3.9]] introduced application-level support and the Bcrypt and SHA256-HMAC hash algorithms using cryptographically secure hashing routines.
 If the PHP version of the web server is 5.3.7 or greater, then the system uses Bcrypt. Otherwise, if the web server is using a version of PHP that is less than 5.3.7, the system will use SHA256-HMAC.

@@ Line 40: / Line 40: @@
 == Hash Schema ==
-WHMCS 5.3.9 introduces application-level support and the Bcrypt and SHA256-HMAC hash algorithms using cryptographically secure hashing routines.
+[Updating|WHMCS 5.3.9] introduced application-level support and the Bcrypt and SHA256-HMAC hash algorithms using cryptographically secure hashing routines.
-If the PHP version of the web server is 5.3.7 or greater, then the system uses Bcrypt.  Otherwise, if the web server is using a version of PHP that is less than 5.3.7, the system will use SHA256-HMAC.
+If the PHP version of the web server is 5.3.7 or greater, then the system uses Bcrypt. Otherwise, if the web server is using a version of PHP that is less than 5.3.7, the system will use SHA256-HMAC.

@@ Line 1: / Line 1: @@
 == Summary ==
-On upgrade to WHMCS 5.3.10 or later, each admin user will have their password automatically rehashed on their next successful login post upgrading.  The rehash will occur for either an API authentication or an Admin Area authentication.  The WHMCS admin(s) does not need to do anything in order to benefit from this low-level change in the product.
+When you upgrade to WHMCS 5.3.10 or later, the system will rehash each admin user's password automatically on the next successful login. The rehash will occur for either API authentication or an Admin Area authentication. WHMCS admins don't need to do anything to benefit from this low-level change in the product.
-If you are performing a fresh install of WHMCS 5.3.9 (or beyond), your admin passwords will simply be hashed with the latest cryptographically secure mechanism available to your web server environment from the start.
+If you're performing a new installation of WHMCS 5.3.9 (or beyond), the system will always hash your admin passwords with the latest cryptographically-secure mechanism available.
 == What You Need To Know ==
-* This security refinement occurs at a low-level and will typically go unobserved in a standard WHMCS installation.
-* Only 3rd-Party Integration Developers that read/write admin authentication details directly from the database will be affected by this change.  The specifics of what they’re doing in their code will determine the complexity of change required to make their integration functional again.
+This security refinement occurs at a low level and, typically, you won't see any evidence of it in a standard WHMCS installation.
-* Password hashes are only updated upon successful login; it is only then that the application has the raw password and is able to establish a new hash.  Because the admin password are stored as one-way hashes, there is no way to perform a batch operation.
 == Public Documentation for Developers ==
-A more thorough example script can be found here [http://www.whmcs.com/download/646/First-Factor-Verification-Demo Admin First Factor Verification Demo]
+<div class="docs-alert-warning">
-<source lang="php">
+<div class="source-cli">
 <?php
+</br>
-use WHMCS\Auth;
+</br>use WHMCS\Auth;
+</br>
-$authAdmin = new Auth;
+</br>$authAdmin = new Auth;
+</br>
-if ($authAdmin->getInfobyUsername($username) && $authAdmin->comparePassword($password)) {
+</br>if ($authAdmin->getInfobyUsername($username) && $authAdmin->comparePassword($password)) {
-    $isValid = true;
+</br>    $isValid = true;
-} else {
+</br>} else {
-    $isValid = false;
+</br>    $isValid = false;
+</br>}
-</source>
+</div>
-<div class="docs-alert-warning">The above code sample is compatible with WHMCS Version 6.0 and later</div>
+<div class="docs-alert-warning">
 == Hash Schema ==
-WHMCS 5.3.9 introduces application-level support and usage of two hash algorithms using cryptographically secure hashing routines.
+WHMCS 5.3.9 introduces application-level support and the Bcrypt and SHA256-HMAC hash algorithms using cryptographically secure hashing routines.
-Both the Bcrypt and SHA256-HMAC algorithms and hashing routines are supported.  If the PHP version of the web server is 5.3.7 or greater, then Bcrypt will be used.  Otherwise, if the web server is using a version of PHP that is less than 5.3.7, SHA256-HMAC will be used.
+If the PHP version of the web server is 5.3.7 or greater, then the system uses Bcrypt.  Otherwise, if the web server is using a version of PHP that is less than 5.3.7, the system will use SHA256-HMAC.

@@ Line 31: / Line 31: @@
 </source>
-This is valid for the 6.x and later versions.
+<div class="docs-alert-warning">The above code sample is compatible with WHMCS Version 6.0 and later</div>
 == Hash Schema ==

@@ Line 15: / Line 15: @@
 Below is the '''''minimum''''' amount of code; it is far from adequate, assumes a lot, but demos the relevant class and methods.
-A more thorough example script can be found here [[Admin First Factor Verification Demo]]
+A more thorough example script can be found here [http://www.whmcs.com/download/646/First-Factor-Verification-Demo Admin First Factor Verification Demo]
 <source lang="php">