VerifyHashedPassword 結果何時為 SuccessRehashNeeded

result的Usermanager.VerifyHashedPassword結果是什麼時候PasswordVerificationResult.SuccessRehashNeeded？

如果出現這樣的結果怎麼辦？

使用時VerifyHashedPassword我只檢查它Success。是否足夠或我應該檢查它Failed？

我在github的PasswordHasher.cs的原始碼中找到了這個

public virtual PasswordVerificationResult VerifyHashedPassword(TUser user, string hashedPassword, string providedPassword)
       {
           if (hashedPassword == null)
           {
               throw new ArgumentNullException(nameof(hashedPassword));
           }
           if (providedPassword == null)
           {
               throw new ArgumentNullException(nameof(providedPassword));
           }

           byte[] decodedHashedPassword = Convert.FromBase64String(hashedPassword);

           // read the format marker from the hashed password
           if (decodedHashedPassword.Length == 0)
           {
               return PasswordVerificationResult.Failed;
           }
           switch (decodedHashedPassword[0])
           {
               case 0x00:
                   if (VerifyHashedPasswordV2(decodedHashedPassword, providedPassword))
                   {
                       // This is an old password hash format - the caller needs to rehash if we're not running in an older compat mode.
                       return (_compatibilityMode == PasswordHasherCompatibilityMode.IdentityV3)
                           ? PasswordVerificationResult.SuccessRehashNeeded
                           : PasswordVerificationResult.Success;
                   }
                   else
                   {
                       return PasswordVerificationResult.Failed;
                   }

               case 0x01:
                   int embeddedIterCount;
                   if (VerifyHashedPasswordV3(decodedHashedPassword, providedPassword, out embeddedIterCount))
                   {
                       // If this hasher was configured with a higher iteration count, change the entry now.
                       return (embeddedIterCount < _iterCount)
                           ? PasswordVerificationResult.SuccessRehashNeeded
                           : PasswordVerificationResult.Success;
                   }
                   else
                   {
                       return PasswordVerificationResult.Failed;
                   }

               default:
                   return PasswordVerificationResult.Failed; // unknown format marker
           }
       }

似乎SuccessRehashNeeded是我們從目前Identity版本更改為另一個版本時的結果。

引用自：https://stackoverflow.com/questions/30251939