Password Security Strategy

Introduction

The Password Security Strategy in this project establishes a multi-layered approach to protecting user credentials through client-side validation, server-side cryptographic hashing, and secure session management. The primary goal is to ensure that plain-text passwords are never stored in the database and that data integrity is maintained from the point of entry in the user interface to the persistent storage layer.

The strategy relies on a decoupled architecture where the hashing logic is abstracted through interfaces, allowing for modular updates to security protocols. It encompasses the entire lifecycle of a password, including registration, profile updates, and authentication checks.

Sources: Back/Alumnos/Api/Servicios/Sha512HasherServicio.cs, Back/Alumnos/Api/Program.cs, Front/src/pages/register.jsx

Client-Side Validation and Transmission

Before data reaches the backend, the frontend application performs initial validation to ensure password quality and consistency. During the registration process, the system enforces a minimum length requirement and a mandatory confirmation check.

Validation Logic

The Register component implements the following checks:

• Presence: Verification that the password field is not empty.
• Consistency: Comparison between the primary password and the confirmation field.
• Complexity: Enforcement of a minimum length of 6 characters.

Sources: Front/src/pages/register.jsx:32-52

The data is transmitted to the backend via a POST request to the /usuarios endpoint, where the password is treated as a sensitive string within the CrearUsuarioDto or ModificarUsuarioDto objects.

Sources: Back/Alumnos/Api/Controllers/UsuariosController.cs:52-53, Back/Alumnos/Api/Comun/Modelos/Usuarios/ModificarUsuarioDto.cs:13

Server-Side Hashing Architecture

The core of the security strategy lies in the backend's use of a cryptographic hashing service. The system utilizes the SHA-512 algorithm to transform plain-text passwords into fixed-length hexadecimal strings.

Hashing Implementation

The implementation is centered around the IHasherServicio interface, which provides a standard method for generating hashes. The concrete implementation, Sha512HasherServicio, performs the following steps:

1. Converts the input string into a UTF-8 byte array.
2. Computes the hash using System.Security.Cryptography.SHA512.
3. Iterates through the resulting byte array to build a hexadecimal string representation (format "x2").

Sources: Back/Alumnos/Api/Servicios/Sha512HasherServicio.cs:17-31, Back/Alumnos/Api/Comun/Interfaces/IHasherServicio.cs

Dependency Injection

The hashing service is registered in the application container as a transient service, ensuring that the UsuariosController can access the security logic without direct coupling to the specific algorithm.

// Registration in Program.cs
builder.Services.AddTransient<IHasherServicio, Sha512HasherServicio>();

Sources: Back/Alumnos/Api/Program.cs:20

Security Data Flow

The following diagram illustrates the flow of a password from registration to storage:

Authentication and Verification

During login and session management, the system verifies credentials by comparing the hashed version of the provided password against the value stored in the database.

Verification Process

The UsuarioSesionServicio is responsible for finding the user based on the username and the password. Because the database stores hashed values, the incoming password must match the stored hash for the authentication to succeed.

Sources: Back/Alumnos/Api/Servicios/UsuarioSesionServicio.cs:23-28, Back/Alumnos/Api/Controllers/UsuariosController.cs:85-88

Sequence Diagram: Registration with Hashing

Password Modification Policy

When a user profile is updated, the security strategy includes logic to handle password changes. In the ModificarUsuario endpoint, the system checks if a new password string has been provided. If the password field in the request is not empty, the system generates a new hash before saving the updated entity.

Sources: Back/Alumnos/Api/Controllers/UsuariosController.cs:85-88, Back/Alumnos/Api/Comun/Modelos/Usuarios/ModificarUsuarioDto.cs:13

Conclusion

The project's Password Security Strategy combines rigorous client-side checks with robust server-side hashing using SHA-512. By abstracting the hashing logic through IHasherServicio and ensuring that only cryptographic hashes reach the persistence layer, the architecture minimizes the risk of credential exposure and ensures compliance with standard security practices.