Changes between Version 22 and Version 23 of P9

Timestamp:

06/23/26 00:06:22 (4 days ago)

Author:

211099

Comment:

--

P9

@@ -847 +847 @@
     : "RegularUser";
 }}}
+== Password Security
+Passwords must never be stored as plaintext in the database. Instead, ChapterX uses BCrypt to hash every password before it is saved.
+BCrypt is configured with a default work factor of 11 rounds, which makes brute-force attacks computationally expensive:
+{{{
+var user = new Domain.Entities.User
+{
+    Username = request.Username,
+    Email    = request.Email,
+    Password = BCrypt.Net.BCrypt.HashPassword(request.Password),
+    ...
+};
+}}}
+At login, the submitted password is verified against the stored hash without ever reconstructing the original:
+{{{
+if (!BCrypt.Net.BCrypt.Verify(request.Password, user.Password))
+    throw new UnauthorizedAccessException("Invalid email or password.");
+}}}