HowTos:Hash and Validate Passwords

Hash and Validate Passwords

This page was created by Wikiadmin on 2026-07-29. Last edited by Wikiadmin on 2026-07-29.

You can add password hashing and password verification to a Turnkey SysUser when you build or maintain authentication outside the packaged SysUserAuthentication pattern.

What this configuration does

A password hash is a stored value derived from a password; it is not the original password. When a user supplies a password at sign-in, you hash/verify that supplied value rather than storing or comparing clear-text passwords.

Add two externally implemented operations to SysUser:

Operation	Arguments	Return value	Use
`HashPassword`	`pwd:String`	`String`	Creates the value that you store as the user's password hash.
`VerifyHashedPassword`	`hash:String; pwd:String`	`Integer`	Checks a supplied password against an existing stored hash.

For example, when a user chooses a new password, pass the entered password to HashPassword and store its returned value in SysUser.PasswordHash. At sign-in, use the existing PasswordHash and the entered password as inputs to VerifyHashedPassword.

Prerequisites

If your application needs registration, sign-in, roles, or external login support, first consider merging SysUserAuthentication. That model pattern includes SysUser.PasswordHash, HashPassword, and SetPassword as part of the authentication model.

This page applies when you need to add the hashing and verification operations to SysUser yourself.

Add the operations to SysUser

Open your model in MDriven Designer.
Select the SysUser class.
Add an operation named HashPassword.
Add one argument named pwd with type String.
Set the operation return type to String.
Add a second operation named VerifyHashedPassword.
Add two arguments: hash:String and pwd:String.
Set the operation return type to Integer.
On both operations, add the tagged value Eco.ExternalLateBound. The tag's value does not matter; the runtime checks that the tagged value exists.

The resulting operation signatures are:

HashPassword(pwd:String):String
VerifyHashedPassword(hash:String; pwd:String):Integer

.NET Core requirement: add Email

For .NET Core, SysUser must also have an Email:String? attribute. The underlying password salt uses the email value.

If the attribute is missing, the Turnkey log reports:

SysUser: No member named Email

Add the attribute to SysUser before testing password hashing in a .NET Core deployment.

Store a new password hash

Store the returned hash, not the password entered by the user.

A typical flow is:

Collect the new password in a UI field.
Call HashPassword with that value.
Assign the returned string to SysUser.PasswordHash.
Save the SysUser.

Example outcome:

Input	Action	Stored result
User enters `123456`	Call `HashPassword` with `pwd = 123456`	Store the returned hash in `PasswordHash`, not `123456`.

The Password Reset Package uses the same approach: its SysUser.SetPassword operation sets PasswordHash by using HashPassword.

Verify a password at sign-in

At sign-in, retrieve the user's stored PasswordHash and pass it together with the password supplied by the user to VerifyHashedPassword.

Interpret the integer result as follows:

Value	Name	Meaning
`0`	`Failed`	The supplied password does not match the stored hash.
`1`	`Success`	The supplied password matches the stored hash.
`2`	`SuccessRehashNeeded`	The supplied password matches, and the hash should be replaced with a newly generated hash.

For SuccessRehashNeeded, treat the password as valid and generate/store a replacement hash by calling HashPassword with the supplied password. This keeps the stored value current when verification indicates that rehashing is required.

CodeDress behavior

When you run with CodeDress, leave the operation body empty for methods tagged Eco.ExternalLateBound.

If the body is not empty, CodeDress executes that body instead of ExternalOverride. An empty body makes code generation create a stub, and the Eco.ExternalLateBound implementation is used instead.

The generated stub may still need a return statement to compile. For example:

public string HashPassword(string pwd)
{
  return "";
}

Do not put password-hashing logic in this stub when the method is configured as Eco.ExternalLateBound.

Troubleshooting

Symptom	Check
Turnkey log contains `SysUser: No member named Email`	In .NET Core, add `Email:String?` to `SysUser`.
The external password implementation is not used with CodeDress	Ensure both operations have the `Eco.ExternalLateBound` tagged value and that their bodies are empty.
Generated code does not compile	Add the required compile-time return statement to the generated stub, such as `return "";` for `HashPassword`.
A password hash is being handled as if it were a password	Store and compare through `HashPassword` and `VerifyHashedPassword`; do not store the entered password itself.

Contents