23 lines
1.2 KiB
C#
23 lines
1.2 KiB
C#
using Microsoft.AspNetCore.Identity;
|
|
using Store.Users.Entities;
|
|
namespace Store.Users.Services;
|
|
|
|
/// <summary>新密码使用带盐哈希；兼容旧 wxxd.user 的明文密码，登录验证不修改密码。</summary>
|
|
public static class UserPassword
|
|
{
|
|
private static readonly PasswordHasher<UserEntity> Hasher = new();
|
|
public static string Hash(UserEntity user, string password) => Hasher.HashPassword(user, password);
|
|
public static bool Verify(UserEntity user, string password)
|
|
{
|
|
if (string.IsNullOrEmpty(user.Password) || string.IsNullOrEmpty(password)) return false;
|
|
// Identity 的密码以固定的版本字节开头，格式损坏时拒绝验证。
|
|
if (user.Password.StartsWith("AQAAAA", StringComparison.Ordinal) || user.Password.StartsWith("AA", StringComparison.Ordinal))
|
|
{
|
|
try { return Hasher.VerifyHashedPassword(user, user.Password, password) != PasswordVerificationResult.Failed; }
|
|
catch (FormatException) { return false; }
|
|
}
|
|
return System.Security.Cryptography.CryptographicOperations.FixedTimeEquals(
|
|
System.Text.Encoding.UTF8.GetBytes(user.Password), System.Text.Encoding.UTF8.GetBytes(password));
|
|
}
|
|
}
|