如何使用Bcrypt加密Django中的密码

Question

我正在尝试使用Bcrypt加密用户在注册时提供的密码,然后使用Bcrypt验证用户在登录时存储在数据库中的散列版本时提供的密码.

有一些关于如何通过Django 文档安装Bcrypt的非常好的文档,但它们实际上并没有向您展示如何使用Bcrypt来哈希密码或使用其他命令.

你需要从某个地方导入Brcrypt吗？如果是这样,它的正确语法是什么？散列密码和将散列密码与非散列密码进行比较的语法是什么？

我在settings.py文件中安装了Bcrypted库,并通过pip安装了Bcrypt.使用Bcrypt还需要做什么？

Answer 1

在你的链接:

所述密码的属性的用户对象是在该格式的字符串:

<algorithm>$<iterations>$<salt>$<hash> 这些是用于存储用户密码的组件,由美元符号字符分隔,包括:散列算法,算法迭代次数(工作因子),随机盐和生成的密码哈希.该算法是Django可以使用的多种单向散列或密码存储算法之一; 见下文.迭代次数描述了算法在哈希上运行的次数.Salt是使用的随机种子,哈希是单向函数的结果.

我在settings.py文件中安装了Bcrypted库...使用Bcrypt还需要做什么？

我不确定第一句话是什么意思.您需要将以下内容放入settings.py:

PASSWORD_HASHERS = (
    'django.contrib.auth.hashers.BCryptSHA256PasswordHasher',
    'django.contrib.auth.hashers.BCryptPasswordHasher',
    'django.contrib.auth.hashers.PBKDF2PasswordHasher',
    'django.contrib.auth.hashers.PBKDF2SHA1PasswordHasher',
    'django.contrib.auth.hashers.SHA1PasswordHasher',
    'django.contrib.auth.hashers.MD5PasswordHasher',
    'django.contrib.auth.hashers.CryptPasswordHasher',
)

使用Bcrypt验证用户在登录数据库中存储的散列版本时提供的密码.

您可以手动执行此操作:

django.contrib.auth.hashers模块提供了一组用于创建和验证散列密码的函数.您可以独立于用户模型使用它们.

check_password(password,encoded)
如果您想通过将纯文本密码与数据库中的散列密码进行比较来手动验证用户身份,请使用便捷函数check_password().它需要两个参数:要检查的纯文本密码,以及要检查的数据库中用户密码字段的完整值,如果匹配则返回True,否则返回False.

https://docs.djangoproject.com/en/1.9/topics/auth/passwords/#module-django.contrib.auth.hashers

或者,您可以使用authenticate():

authenticate(**credentials)
要验证给定的用户名和密码,请使用authenticate().它以关键字参数的形式获取凭据,对于默认配置,这是用户名和密码,如果密码对于给定的用户名有效,则返回User对象.如果密码无效,则authenticate()返回None.例:

from django.contrib.auth import authenticate

user = authenticate(username='john', password='password to check')

if user is not None:
    # the password verified for the user
    if user.is_active:
        print("User is valid, active and authenticated")
    else:
        print("The password is valid, but the account has been disabled!")
else:
    # the authentication system was unable to verify the username and password
    print("The username and password were incorrect.")

https://docs.djangoproject.com/en/1.9/topics/auth/default/#authenticating-users

这里有些例子:

(django186p34)~/django_projects/dj1$ python manage.py shell

Python 3.4.3 (v3.4.3:9b73f1c3e601, Feb 23 2015, 02:52:03) 
[GCC 4.2.1 (Apple Inc. build 5666) (dot 3)] on darwin
Type "help", "copyright", "credits" or "license" for more information.
(InteractiveConsole)

>>> from django.conf import settings
>>> print(settings.PASSWORD_HASHERS)

('django.contrib.auth.hashers.PBKDF2PasswordHasher',
 'django.contrib.auth.hashers.PBKDF2SHA1PasswordHasher',
 'django.contrib.auth.hashers.BCryptSHA256PasswordHasher',
 'django.contrib.auth.hashers.BCryptPasswordHasher',
 'django.contrib.auth.hashers.SHA1PasswordHasher',
 'django.contrib.auth.hashers.MD5PasswordHasher',
 'django.contrib.auth.hashers.UnsaltedSHA1PasswordHasher',
 'django.contrib.auth.hashers.UnsaltedMD5PasswordHasher', 
 'django.contrib.auth.hashers.CryptPasswordHasher')

这些是默认值:我的settings.py中没有条目PASSWORD_HASHERS.

>>> from django.contrib.auth.models import User

>>> my_user = User.objects.create_user('ea87', 'ea@gmail.com', '666monkeysAndDogs777')

>>> my_user.save()
>>> my_user.password
'pbkdf2_sha256$20000$L7uq6goI1HIl$RYqywMgPywhhku/YqIxWKbpxODBeczfLm5zthHjNSSk='
>>> my_user.username
'ea87'

>>> from django.contrib.auth import authenticate

>>> authenticate(username='ea87', password='666monkeysAndDogs777')
<User: ea87>

>>> print(authenticate(username='ea87', password='wrong password'))
None

>>> from django.contrib.auth.hashers import check_password

>>> check_password('666monkeysAndDogs777', my_user.password)
True

>>> exit()

接下来,我将以下内容添加到settings.py中:

PASSWORD_HASHERS = (
    'django.contrib.auth.hashers.BCryptSHA256PasswordHasher',
    'django.contrib.auth.hashers.BCryptPasswordHasher',
    'django.contrib.auth.hashers.PBKDF2PasswordHasher',
    'django.contrib.auth.hashers.PBKDF2SHA1PasswordHasher',
    'django.contrib.auth.hashers.SHA1PasswordHasher',
    'django.contrib.auth.hashers.MD5PasswordHasher',
    'django.contrib.auth.hashers.CryptPasswordHasher',
)

(django186p34)~/django_projects/dj1$ python manage.py shell

Python 3.4.3 (v3.4.3:9b73f1c3e601, Feb 23 2015, 02:52:03) 
[GCC 4.2.1 (Apple Inc. build 5666) (dot 3)] on darwin
Type "help", "copyright", "credits" or "license" for more information.
(InteractiveConsole)

>>> from django.conf import settings
>>> print(settings.PASSWORD_HASHERS)
('django.contrib.auth.hashers.BCryptSHA256PasswordHasher',
 'django.contrib.auth.hashers.BCryptPasswordHasher',
 'django.contrib.auth.hashers.PBKDF2PasswordHasher',
 'django.contrib.auth.hashers.PBKDF2SHA1PasswordHasher',
 'django.contrib.auth.hashers.SHA1PasswordHasher',
 'django.contrib.auth.hashers.MD5PasswordHasher', 
 'django.contrib.auth.hashers.CryptPasswordHasher')

注意元组前面的bcrypt哈希.

>>> from django.contrib.auth.models import User

>>> user = User.objects.get(username='ea87')
>>> user
<User: ea87>

>>> user.password
'pbkdf2_sha256$20000$DS20ZOCWTBFN$AFfzg3iC24Pkj5UtEu3O+J8KOVBQvaLVx43D0Wsr4PY='

>>> user.set_password('666monkeysAndDogs777')
>>> user.password
'bcrypt_sha256$$2b$12$QeWvpi7hQ8cPQBF0LzD4C.89R81AV4PxK0kjVXG73fkLoQxYBundW'

您可以看到密码已更改为bcrypt版本.