warrentyexpired/ModernUO
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

docs: say why a cheap digest still earns its thread hop

Browse source 
The comment conceded a needless hop for MD5 and SHA1. It is not needless:
AccountSecurity.Configure refuses anything below SHA2 as the configured
algorithm, so those only ever appear as a stored hash awaiting migration.
That makes NeedsPasswordUpgrade true, so the job carries the upgrade hash and
the microsecond digest is never the whole job.
This commit is contained in:
Kamron Batman 2026-08-08 22:43:48 -07:00
parent 91c8873b7a
commit b95be044bd
No known key found for this signature in database
GPG key ID: 7D81DF26D9A5D94A
1 changed files with 6 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

8
Projects/UOContent/Accounting/AccountHandler.cs
View file

@ -398,8 +398,12 @@ public static class AccountHandler
/// <summary>
/// Hands the password check to the worker, whatever algorithm it uses. Every protection is safe
/// to run off the loop, so there is no carve-out; a cheap digest pays a thread hop it does not
/// need, but login latency is not what this is protecting.
/// to run off the loop, so there is no carve-out.
///
/// Nor is a cheap digest worth carving out. <c>AccountSecurity.Configure</c> refuses anything
/// below SHA2 as the configured algorithm, so MD5 and SHA1 only ever appear as a stored hash
/// awaiting migration -- which makes <c>NeedsPasswordUpgrade</c> true, and the job carries the
/// upgrade hash that dominates it. The microsecond digest is never the whole job.
/// </summary>
private static PasswordCheckDispatch DispatchPasswordCheck(AccountLoginEventArgs e, Account acct, string pw)
{