#483 Quick fix to add hashPasswordForCookie to Guard.#484
#483 Quick fix to add hashPasswordForCookie to Guard.#484steffjenl wants to merge 3 commits intoauth0:mainfrom
Conversation
|
Yesterday, Laravel merged a fix to fallback to the old insecure behavior if the method is missing: laravel/framework#58385 I think this laravel-auth0 PR should still be merged: Not doing so enables Laravel to run in the old unsafe way of storing too much password details in cookies. Merging this removes a liability, and strengthens the Auth0 USP as being more secure. |
Codecov Report❌ Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## main #484 +/- ##
============================================
- Coverage 99.92% 99.47% -0.45%
- Complexity 538 539 +1
============================================
Files 31 31
Lines 1340 1346 +6
============================================
Hits 1339 1339
- Misses 1 7 +6
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
|
This has been released in v7.22.0. @steffjenl Thanks for raising this PR. |
Changes
Add missing hashPasswordForCookie function in AuthenticationGuard
References
#483
laravel/framework@b5f9532
Testing
Contributor Checklist