Password and OAuth token storage (FREE ALL)

GitLab administrators can configure how passwords and OAuth tokens are stored.

Password storage

• PBKDF2+SHA512 introduced in GitLab 15.2 with flags named pbkdf2_password_encryption and pbkdf2_password_encryption_write. Disabled by default.
• Feature flags removed in GitLab 15.6 and PBKDF2+SHA512 was made available to all GitLab instances running in FIPS mode.

GitLab stores user passwords in a hashed format to prevent passwords from being stored as plain text.

GitLab uses the Devise authentication library to hash user passwords. Created password hashes have these attributes:

• Hashing:
  • bcrypt: By default, the bcrypt hashing function is used to generate the hash of the provided password. This cryptographic hashing function is strong and industry-standard.
  • PBKDF2+SHA512: PBKDF2+SHA512 is supported:
    • In GitLab 15.2 to GitLab 15.5 when pbkdf2_password_encryption and pbkdf2_password_encryption_write feature flags are enabled.
    • In GitLab 15.6 and later when FIPS mode is enabled (feature flags are not required).
• Stretching: Password hashes are stretched to harden against brute-force attacks. By default, GitLab uses a stretching factor of 10 for bcrypt and 20,000 for PBKDF2 + SHA512.
• Salting: A cryptographic salt is added to each password to harden against pre-computed hash and dictionary attacks. To increase security, each salt is randomly generated for each password, with no two passwords sharing a salt.

OAuth access token storage

• PBKDF2+SHA512 introduced in GitLab 15.3 with flag named hash_oauth_tokens.
• Enabled by default in GitLab 15.5.
• Feature flag removed in GitLab 15.6.

OAuth access tokens are stored in the database in PBKDF2+SHA512 format. As with PBKDF2+SHA512 password storage, access token values are stretched 20,000 times to harden against brute-force attacks.