Bureaucrats, editor, reviewer, Administrators
13,554
edits
Changes
Jump to navigation
Jump to search
Moreover, passwords Passwords in commands and XQuery functions are now specified in '''plain text''' (yes!). The rationale behind this is:
Please remember You will be safe if you follow basic security measures: ensure that your password will not end up in your bash history, and avoid sending passwords via ordinary REST requests, etc.
no edit summary
* Local permissions are now defined for database '''glob patterns''' instead of single databases. Both local and global permissions are stored in the same file.
* A new [[User Module]] is available, which allows user management via '''XQuery'''.
* The md5 MD5 password hash hashing has been replaced discarded, as many md5 hashes can be easily uncovered with rainbow tables.* '''salted Salted sha256''' and '''digest''' hashes are now used for authentication (the current timestamp will be used as salt).* Additionally, '''digest''' hashes are used in the client/server architecture and the [[Clients|Language Bindings]], and in the [[Web Application|HTTP Context]] if the [[Options#AUTHMETHOD|AUTHMETHOD]] is set to {{Code|Digest}}.
{{Mark|Warning}}: As the available md5 hashes cannot automatically be converted to the new format, existing credentials will be ignored, and you will need to recreate your user data. Moreover, we will incrementally provide new [[Clients|Language Bindings]], which will be based on the digest hashes.
* The server can now create different hashes from the original password.* The encoding Transmission of passwords as md5 has not been safe anyway, because md5 hashes for popular passwords as indicated above.* Different hash values can now be easily uncovered with rainbow tablescreated from the original password.
==Rules==
