# password\_hash & salt with facebook authentication
**URL:** https://meta.discourse.org/t/password-hash-salt-with-facebook-authentication/42649
**Category:** Development
**Created:** [2016年四月16日 13:15 UTC](https://meta.discourse.org/t/password-hash-salt-with-facebook-authentication/42649 "2016-04-16T13:15:35Z")
**Posts on this page:** 6
**Page:** 1
### Author:  [@will\_io](https://meta.discourse.org/u/will_io)
#### Post date: [2016年四月16日 13:15 UTC](https://meta.discourse.org/t/password-hash-salt-with-facebook-authentication/42649/1 "2016-04-16T13:15:35Z")
What in the facebook API becomes the password\_hash and salt when a user signs up and authenticates using facebook?
---
### Author:  [@fantasticfears](https://meta.discourse.org/u/fantasticfears)
#### Post date: [2016年四月16日 13:58 UTC](https://meta.discourse.org/t/password-hash-salt-with-facebook-authentication/42649/2 "2016-04-16T13:58:07Z")
They are remain empty.
---
### Author:  [@will\_io](https://meta.discourse.org/u/will_io)
#### Post date: [2016年四月16日 14:10 UTC](https://meta.discourse.org/t/password-hash-salt-with-facebook-authentication/42649/3 "2016-04-16T14:10:14Z")
I thought there was a portion of users who – if they have their facebook settings set a specific way – could possibly both authenticate using facebook and also set a password.
I think that’s my problem. Or I might have a different problem.
Either way I have a user with `Facebook()` as a login and a password\_hash/salt in the db.
Edit: I just checked with a dummy facebook acct. A password\_hash and salt are still being set at registration if I use facebook. So something on my end might be drastically wrong I just don’t know what.
---
### Author:  [@fantasticfears](https://meta.discourse.org/u/fantasticfears)
#### Post date: [2016年四月16日 18:22 UTC](https://meta.discourse.org/t/password-hash-salt-with-facebook-authentication/42649/4 "2016-04-16T18:22:10Z")
I am not following.
It doesn’t matter at all. You don’t have **chance** to set password when using an OAuth services if they provide username and email.
The user can use their setting page to reset their password.
---
### Author:  [@pfaffman](https://meta.discourse.org/u/pfaffman)
#### Post date: [2016年四月20日 13:02 UTC](https://meta.discourse.org/t/password-hash-salt-with-facebook-authentication/42649/5 "2016-04-20T13:02:31Z")
Users can authenticate against any of the available mechanisms. As long as the email is the same, a single account can authenticate against Google, Facebook, or a local password. Does that explain what you are seeing?
---
### Author:  [@Hyan](https://meta.discourse.org/u/Hyan)
#### Post date: [2023年三月24日 02:17 UTC](https://meta.discourse.org/t/password-hash-salt-with-facebook-authentication/42649/6 "2023-03-24T02:17:10Z")
我也有同样的问题。为什么通过 OAuth 提供商注册的账户（我使用的是 Discourse OAuth2 Basic 插件）的 password\_hash（或 salt）仍然存储在数据库中？我的实验证明，用户能够通过其首选项面板中的重置密码功能设置的本地密码登录（如果启用 OAuth2 并进行设置时没有禁用“启用本地登录”）。他们也可以通过其 OAuth2 提供商凭据登录。正如 pfaffman 所说，这两种机制都是允许的。
我想知道 password\_hash 的初始原始值是多少？