我试图login在Pyramid中验证加密密码.因此,如果用户和密码匹配,则系统将授权用户.目前我发现在数据库中加密密码并且输入金字塔login形式的密码未加密时,编写一个比较密码的函数很困难.现在,我没有在登录视图中进行验证.
我是处理安全措施/代码的整个过程的新手,并希望这样做.我正在看这个Auth教程,但是User课堂上的加密略有不同,我正在使用Pyramid的Auth工具包.任何关于如何成功和巧妙地做到这一点的指导将受到高度赞赏.
软件:Python 2.7.9,Pyramid 1.5.7,SQLAlchemy 1.0.9
数据库类:
class User(Base):
__tablename__ = 'users'
id = Column(Integer, primary_key=True)
username = Column(String(15), nullable=False, unique=True)
email = Column(String(300))
password = Column(String(300), nullable=False)
def __init__(self, username, password, email):
self.username = username
self.password = hashlib.sha224(password).hexdigest()
self.email = email
def __repr__(self):
return "<User(username ='%s', password='%s', email='%s')>" % (self.username, self.password, self.email)
意见
@view_config(route_name='login', renderer='templates/login.jinja2')
@forbidden_view_config(renderer='templates/login.jinja2')
def login(request):
login_url = request.route_url('login')
referrer = request.url
if referrer == login_url:
referrer = '/' …作为python的新手,我不太清楚为什么我会得到不一致的结果.我注册了一个用户,我的表中的密码最终成为哈希版本.当用户更新其密码时,表中的密码最终为未散列的版本.显然,我想要哈希版本.我究竟做错了什么？(如果重要的话,我正在使用SQLAlchemy和mysql.)
我有以下内容:
def hash_password(password):
blah, blah, blah # hash my password here
return hashed_password
class User(Base):
__tablename__ = 'mytable'
email = Column('email')
_password = Column('password')
def _get_password(self):
return self._password
def _set_password(self, password):
self._password = hash_password(password)
password = property(_get_password, _set_password)
password = synonym('_password', descriptor=password)
def __init__(self, password="", email=""):
self.email = email
self.password = password
@classmethod
def register(cls, email, password):
return DBSession.add(User(email=email,password=password)) # this correctly hashes the password
@classmethod
def update(cls, email, password):
return DBSession.query(cls).filter(cls.email == email).update({'password': password}) #password ends up being …