Skip to content

Password and OAuth token storage

DETAILS: Tier: Free, Premium, Ultimate Offering: GitLab.com, Self-managed, GitLab Dedicated

GitLab administrators can configure how passwords and OAuth tokens are stored.

Password storage

  • PBKDF2+SHA512 introduced in GitLab 15.2 with flags named pbkdf2_password_encryption and pbkdf2_password_encryption_write. Disabled by default.
  • Feature flags removed in GitLab 15.6 and PBKDF2+SHA512 was made available to all GitLab instances running in FIPS mode.

GitLab stores user passwords in a hashed format to prevent passwords from being stored as plain text.

GitLab uses the Devise authentication library to hash user passwords. Created password hashes have these attributes:

  • Hashing:
    • bcrypt: By default, the bcrypt hashing function is used to generate the hash of the provided password. This cryptographic hashing function is strong and industry-standard.
    • PBKDF2+SHA512: PBKDF2+SHA512 is supported:
      • In GitLab 15.2 to GitLab 15.5 when pbkdf2_password_encryption and pbkdf2_password_encryption_write feature flags are enabled.
      • In GitLab 15.6 and later when FIPS mode is enabled (feature flags are not required).
  • Stretching: Password hashes are stretched to harden against brute-force attacks. By default, GitLab uses a stretching factor of 10 for bcrypt and 20,000 for PBKDF2 + SHA512.
  • Salting: A cryptographic salt is added to each password to harden against pre-computed hash and dictionary attacks. To increase security, each salt is randomly generated for each password, with no two passwords sharing a salt.

OAuth access token storage

OAuth access tokens are stored in the database in PBKDF2+SHA512 format. As with PBKDF2+SHA512 password storage, access token values are stretched 20,000 times to harden against brute-force attacks.