SMF Login Password

[jriani]

How is a users password sent over the wire? Is there a Javascript SHA1 implementation that sends the password hashed? Or does hashing and concating with salt happen on server only?

[Colin]

It is hashed client side.

Code Select Expand


function hashLoginPassword(doForm, cur_session_id)
{
// Compatibility.
if (cur_session_id == null)
cur_session_id = smf_session_id;

if (typeof(hex_sha1) == 'undefined')
return;
// Are they using an email address?
if (doForm.user.value.indexOf('@') != -1)
return;

// Unless the browser is Opera, the password will not save properly.
if (!('opera' in window))
doForm.passwrd.autocomplete = 'off';

doForm.hash_passwrd.value = hex_sha1(hex_sha1(doForm.user.value.php_to8bit().php_strtolower() + doForm.passwrd.value.php_to8bit()) + cur_session_id);

// It looks nicer to fill it with asterisks, but Firefox will try to save that.
if (is_ff != -1)
doForm.passwrd.value = '';
else
doForm.passwrd.value = doForm.passwrd.value.replace(/./g, '*');
}

[Arantor]

You can send it over the wire bare though SSL strongly recommended for such things.