Implement Argon2 for password hashing about phalcon

[JABirchall]

I dont see what needs implimenting? If you use php7.2 you can just use password_hash('password', PASSWORD_ARGON2I) What does phalcon need to impliment here? Unless your asking phalcon to impliment argon to be used on versions < 7.2?

[RayHughes]

I dont see what needs implimenting? If you use php7.2 you can just use password_hash('password', PASSWORD_ARGON2I) What does phalcon need to impliment here? Unless your asking phalcon to impliment argon to be used on versions < 7.2?

Yes you are correct. However, Phalcon has a security wrapper (https://docs.phalconphp.com/hu/3.4/security) that is injectable through the DI container. Using the security component allows users to call it throughout there module with pre-configured properties etc.

Yes you could technically write a wrapper around the password_hash() method and pre configure it yourself but why reinvent the wheel.

This is a framework after all and in its current form it does provide password hashing abilities, so it should either improve on them or drop them completely.

[ViltusVilks]

Yes, it is a framework, which can be "overriden"

1. Extend Phalcon\Security, override needed part
2. Set in DI for security \MyApp\Lib\Whatever\MySecurity

Problem for Argon can be that it needs library/extension and these checks will be done for all "phalcon customers" when upgraded.

Other point - use OAuth2/JWT/SSO with authentication servers (quite easy with Docker deployment) so You can forget about passwords, but will have bit more work to implement authorization layer

[JABirchall]

Yes you are correct. However, Phalcon has a security wrapper (https://docs.phalconphp.com/hu/3.4/security) that is injectable through the DI container.

Ahh ok, So maybe would be best to NFR a $security->setPasswordHashAlgorithme(int $algorithmeConst)

[RayHughes]

Not an available option which was the point for my issue...

[JABirchall]

@RayHughes Thats what I mean, Maybe phalcon should add such a method to allow devs choose which hashing function to use since PHP has so many now and are prolly going to add more.

[RayHughes]

@JABirchall my bad on the interpretation and I agree with your suggestion.

[niden]

Closing in favor of phalcon/cphalcon#13855. Will revisit if the community votes for it, or in later versions.