密码和密码哈希的模型和数据库表

Question

我在数据库表User(id, password_hash, ....)和它的模型：

case class User(
    id: Pk[Long] = NotAssigned, 
    email: String, 
    password: Option[String] = None, 
    passwordHash: Option[String] = None 
) 


object User { 

    def create(newUser: User): Option[Long] = //..... 

    //on("password_hash" -> generatePasswordHash(newUser.password) 

    def generatePasswordHash(p: String) = //.... 
} 

的一点是Password场只存在于模型User并不仅填补了我注册一个新用户：

val newUser = User(email = emailFromForm, password = Some(passwordFromForm)) 

我发送给db只有密码的散列。显然，当我从数据库检索它，Password字段在None，但PasswordHash有一个值。

我发Password和PasswordHash是选项，因为我认为他们应该是Options，不应该吗？不过，我不确定这是对还是错。

问题是我的这是一个好方法？

Answer 1

为什么你想要User.password呢？

case class User(
    id: Pk[Long] = NotAssigned, 
    email: String, 
    passwordHash: String 
) 

object User { 
    // or maybe Option[User] or Try[User] 
    def create(email: String, password: String): Option[Long] = { 
    val passwordHash = hashPassword(hash) 
    val newUser = User(email, passwordHash) 
    // save newUser to DB 
    } 

    // you may want to distinguish between "no such email" and "wrong password" 
    // in which case you'd have something like Either[PasswordCheckFailure, User] 
    def checkPassword(email: String, password: String): Option[User] = { 
    val possibleUser: Option[User] = // get user by email 
    possibleUser.filter(_.passwordHash = hashPassword(password)) 
    } 

    private def hashPassword(password: String): String = ... 
} 

你也可能想要一个盐，例如， https://crackstation.net/hashing-security.htm。在这种情况下，你要么把它存储在同一领域为密码或者添加一个字段：

case class User(
    id: Pk[Long] = NotAssigned, 
    email: String, 
    passwordHash: String, 
    passwordSalt: String = // generate random string 
)