如果我不在请求主体中指定hashfunction值，目录API会将密码存储为纯文本吗？

发布于 2025-02-10 20:04:14 字数 54 浏览 1 评论 0 原文

如果我不在请求正文中指定hashfunction值，则将目录API将密码存储为纯文本。请告诉我

原文

分享到QQ

分享到微博

如果你对这篇内容有疑问，欢迎到本站社区发帖提问参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。

发布评论

需要登录才能够评论，你可以免费注册一个本站的账号。

清引 2025-02-17 20:04:14

如果我们检查管理用户我们可以可以，我们可以查看Google希望我们如何使用 user.insert 方法。就密码而言，我们可以将一些内容添加到请求的正文中。

密码本身和用于创建密码的障碍，

"password": "new user password",
"hashFunction": "SHA-1",
"changePasswordAtNextLogin": false,

如果我们在文档中进一步阅读，我们将找到此行。

新用户帐户需要密码。如果指定了障碍，则密码必须是有效的哈希键。有关更多信息，请参见API参考。

因此，您必须用清晰的文字发送密码。然后，Google将使用他们选择的所有散列方法在他们的末端将其放置。如果您然后进行用户。在NER用户创建的heshfunction上，将填写hashfunction，Google会告诉您他们使用的哪种哈希功能。

您确实有其他选择可以决定要使用哪种哈希功能。通过作为您的请求的一部分发送hashfunction。但是，您必须将密码本身放置。 如果指定了障碍，则密码必须是有效的哈希键。此选项可能会被认为更安全，因为您没有向Google发送清晰的文本密码以进行哈希。

因此，如果您想将其发送清晰的文本，只需让Google Hasht在其末端。但是，如果您有自己的偏爱哈希功能（不是所有人），那么只要谷歌显然只支持md5，sha1和crypt

资源：-user

我添加了一个问题请求< a href =“ https://issuetracker.google.com/issues/237333031” rel =“ nofollow noreferrer”> 237333031 以在文档中添加一些澄清。

If we check the docs for Manage users we can see how google wants us to use the User.insert method. As far as the password goes there are a few things we can add to the body of the request.

The password itself and the hashFunction that was used to create the password

"password": "new user password",
"hashFunction": "SHA-1",
"changePasswordAtNextLogin": false,

If we read further down in the docs we will find this line.

A password is required for new user accounts. If a hashFunction is specified, the password must be a valid hash key. For more information, see the API Reference.

So you must send a password, in clear text. Then Google will hash it on their end using what ever hashing method they choose. If you then do a user.get on the ner user created the hashFunction will be filled in and google will tell you which type of hash function they used.

You do have another option you can decide yourself which hash function you want to use. By sending hashFunction as part of your request. However you then must hash the password itself. If a hashFunction is specified, the password must be a valid hash key. This option may by some be considered more secure as you are not sending a clear text password to google for hashing.

So if you want to send it clear text just let google hasht it on their end. However if your have your own favoriate hash function (dont we all) then feel free to use that as long as its one of these apparently google only supports MD5, SHA1 and crypt

resource:-user