Does has_secure_password use any form of salting?
has_secure_password uses bcrypt-ruby. bcrypt-ruby automatically handles the storage and generation of salts for you. A typical hash from bcrypt-ruby looks like this: $2a$10$4wXszTTd7ass8j5ZLpK/7.ywXXgDh7XPNmzfIWeZC1dMGpFghd92e. This hash is split internally using the following function:
def split_hash(h) _, v, c, mash = h.split('$') return v, c.to_i, h[0, 29].to_str, mash[-31, 31].to_strendFor the example hash this function yields:
- version: 2a
- cost: 10
- salt: $2a$10$4wXszTTd7ass8j5ZLpK/7.
- hash: ywXXgDh7XPNmzfIWeZC1dMGpFghd92e
The ==-function of BCrypt::Password extracts the salt and applies it to the passed string:
BCrypt::Password.create('bla') == 'bla' # => true