3 KiB
| stage | group | info | type |
|---|---|---|---|
| Manage | Authentication and Authorization | To determine the technical writer assigned to the Stage/Group associated with this page, see https://about.gitlab.com/handbook/product/ux/technical-writing/#assignments | reference |
Password and OAuth token storage (FREE)
GitLab administrators can configure how passwords and OAuth tokens are stored.
Password storage
PBKDF2 and SHA512 introduced in GitLab 15.2 with flags named
pbkdf2_password_encryptionandpbkdf2_password_encryption_write. Disabled by default.
GitLab stores user passwords in a hashed format to prevent passwords from being stored as plain text.
GitLab uses the Devise authentication library to hash user passwords. Created password hashes have these attributes:
-
Hashing:
-
BCrypt: By default, the
bcrypthashing function is used to generate the hash of the provided password. This cryptographic hashing function is strong and industry-standard. -
PBKDF2 and SHA512: Starting in GitLab 15.2, PBKDF2 and SHA512 are supported behind the following feature flags (disabled by default):
pbkdf2_password_encryption- Enables reading and comparison of PBKDF2 + SHA512 hashed passwords and supports fallback for BCrypt hashed passwords.pbkdf2_password_encryption_write- Enables new passwords to be saved using PBKDF2 and SHA512, and existing BCrypt passwords to be migrated when users sign in.
FLAG: On self-managed GitLab, by default this feature is not available. To make it available, ask an administrator to enable the feature flags named
pbkdf2_password_encryptionandpbkdf2_password_encryption_write.
-
-
Stretching: Password hashes are stretched to harden against brute-force attacks. By default, GitLab uses a stretching factor of 10 for BCrypt and 20,000 for PBKDF2 + SHA512.
-
Salting: A cryptographic salt is added to each password to harden against pre-computed hash and dictionary attacks. To increase security, each salt is randomly generated for each password, with no two passwords sharing a salt.
OAuth access token storage
- PBKDF2+SHA512 introduced in GitLab 15.3 with flag named
hash_oauth_tokens.- Enabled by default in GitLab 15.5.
- Feature flag removed in GitLab 15.6.
OAuth access tokens are stored in the database in PBKDF2+SHA512 format. As with PBKDF2+SHA512 password storage, access token values are stretched 20,000 times to harden against brute-force attacks.