You are viewing a plain text version of this content. The canonical link for it is here.
Posted to user@shiro.apache.org by Paulo Pires <pj...@ubiwhere.com> on 2012/07/24 15:36:15 UTC

Flow question

Hi list,

I'm on a dilemma on whether I should secure user credentials (at least
the password) before sending over HTTPS to a Shiro-protected REST API.

Am I wrong to assume that if I salt my password in the client and send
it to the REST login, Shiro won't be able to check it against my database?

What would be your approach for an mobile client that needs to
authenticate before any REST requests are made?

Cheers,

-- 
Paulo Pires

Re: Flow question

Posted by Paulo Pires <pj...@ubiwhere.com>.
I'll be doing both the register and the authentication REST requests.

For now, I am persisting the password hashes by hand in the database, 
after hashing them with Shiro CLI tool.

Cheers,
PP

On Tue Jul 24 17:17:50 2012, Les Hazlewood wrote:
> Are you trying to set the password for the first time?  Or using an
> existing password to authenticate REST requests?
>
> Cheers,
>
> --
> Les Hazlewood | @lhazlewood
> CTO, Stormpath | http://stormpath.com | @goStormpath | 888.391.5282
> Stormpath wins GigaOM Structure Launchpad Award! http://bit.ly/MvZkMk
> On Tue, Jul 24, 2012 at 6:36 AM, Paulo Pires <pjpires@ubiwhere.com
> <ma...@ubiwhere.com>> wrote:
>
>     Hi list,
>
>     I'm on a dilemma on whether I should secure user credentials (at least
>     the password) before sending over HTTPS to a Shiro-protected REST API.
>
>     Am I wrong to assume that if I salt my password in the client and send
>     it to the REST login, Shiro won't be able to check it against my
>     database?
>
>     What would be your approach for an mobile client that needs to
>     authenticate before any REST requests are made?
>
>     Cheers,
>
>     --
>     Paulo Pires
>
>

--
Paulo Pires

Re: Flow question

Posted by Les Hazlewood <lh...@apache.org>.
Are you trying to set the password for the first time?  Or using an
existing password to authenticate REST requests?

Cheers,

--
Les Hazlewood | @lhazlewood
CTO, Stormpath | http://stormpath.com | @goStormpath | 888.391.5282
Stormpath wins GigaOM Structure Launchpad Award! http://bit.ly/MvZkMk
On Tue, Jul 24, 2012 at 6:36 AM, Paulo Pires <pj...@ubiwhere.com> wrote:

> Hi list,
>
> I'm on a dilemma on whether I should secure user credentials (at least
> the password) before sending over HTTPS to a Shiro-protected REST API.
>
> Am I wrong to assume that if I salt my password in the client and send
> it to the REST login, Shiro won't be able to check it against my database?
>
> What would be your approach for an mobile client that needs to
> authenticate before any REST requests are made?
>
> Cheers,
>
> --
> Paulo Pires
>
>