'Compare hashed password vs searching for user with hashed value
Technically speaking is there any difference to these two login flows
The first:
- Find user by email/username/etc.
- Use a library like bcrypt to compare plain text password to hashed one
- Return user if comparison true / return invalid credentials if comparison false
The second:
- Hash the plain text password sent by user
- Search for user by both the email and hashed password
- If user found return him to the client / if user not found return invalid credentials
Sources
This article follows the attribution requirements of Stack Overflow and is licensed under CC BY-SA 3.0.
Source: Stack Overflow
| Solution | Source |
|---|
