在您提供的链接中:
User对象的密码属性是以下格式的字符串:
<algorithm>$<iterations>$<salt>$<hash>
这些是用于存储用户密码的组件,由美元符号字符分隔,并包括:哈希算法、算法迭代次数(工作因子)、随机盐和生成的密码哈希。算法是Django可以使用的一些单向哈希或密码存储算法之一;请参见下文。迭代描述了算法在哈希上运行的次数。盐是用于生成随机种子的随机种子,哈希是单向函数的结果。
我在 settings.py 文件中安装了 Bcrypted 库...
还需要做什么才能使用 Bcrypt?
我不确定第一句话的意思。您需要将以下内容放入 settings.py 文件中:
PASSWORD_HASHERS = (
'django.contrib.auth.hashers.BCryptSHA256PasswordHasher',
'django.contrib.auth.hashers.BCryptPasswordHasher',
'django.contrib.auth.hashers.PBKDF2PasswordHasher',
'django.contrib.auth.hashers.PBKDF2SHA1PasswordHasher',
'django.contrib.auth.hashers.SHA1PasswordHasher',
'django.contrib.auth.hashers.MD5PasswordHasher',
'django.contrib.auth.hashers.CryptPasswordHasher',
)
使用Bcrypt对用户登录时提供的密码进行验证,以确保其与存储在数据库中的哈希版本相匹配。
您可以手动完成此操作:
django.contrib.auth.hashers模块提供了一组函数来创建和验证哈希密码。您可以独立于用户模型使用它们。
check_password(password, encoded):如果您想通过将明文密码与数据库中的哈希密码进行比较来手动验证用户,则可以使用方便的函数check_password()。它接受两个参数:要检查的明文密码和要检查的数据库中用户密码字段的完整值,并在它们匹配时返回True,否则返回False。
https://docs.djangoproject.com/en/1.9/topics/auth/passwords/#module-django.contrib.auth.hashers
或者,您可以使用authenticate()
:
authenticate(**credentials)
To authenticate a given username and password, use authenticate(). It takes credentials in the form of
keyword arguments, for the default configuration this is username and
password, and it returns a User object if the password is valid for
the given username. If the password is invalid, authenticate() returns
None. Example:
from django.contrib.auth import authenticate
user = authenticate(username='john', password='password to check')
if user is not None:
if user.is_active:
print("User is valid, active and authenticated")
else:
print("The password is valid, but the account has been disabled!")
else:
print("The username and password were incorrect.")
https://docs.djangoproject.com/en/1.9/topics/auth/default/#authenticating-users
这里是一些例子:
(django186p34)~/django_projects/dj1$ python manage.py shell
Python 3.4.3 (v3.4.3:9b73f1c3e601, Feb 23 2015, 02:52:03)
[GCC 4.2.1 (Apple Inc. build 5666) (dot 3)] on darwin
Type "help", "copyright", "credits" or "license" for more information.
(InteractiveConsole)
>>> from django.conf import settings
>>> print(settings.PASSWORD_HASHERS)
('django.contrib.auth.hashers.PBKDF2PasswordHasher',
'django.contrib.auth.hashers.PBKDF2SHA1PasswordHasher',
'django.contrib.auth.hashers.BCryptSHA256PasswordHasher',
'django.contrib.auth.hashers.BCryptPasswordHasher',
'django.contrib.auth.hashers.SHA1PasswordHasher',
'django.contrib.auth.hashers.MD5PasswordHasher',
'django.contrib.auth.hashers.UnsaltedSHA1PasswordHasher',
'django.contrib.auth.hashers.UnsaltedMD5PasswordHasher',
'django.contrib.auth.hashers.CryptPasswordHasher')
这些是默认设置:我的settings.py中没有
PASSWORD_HASHERS
条目。
>>> from django.contrib.auth.models import User
>>> my_user = User.objects.create_user('ea87', 'ea@gmail.com', '666monkeysAndDogs777')
>>> my_user.save()
>>> my_user.password
'pbkdf2_sha256$20000$L7uq6goI1HIl$RYqywMgPywhhku/YqIxWKbpxODBeczfLm5zthHjNSSk='
>>> my_user.username
'ea87'
>>> from django.contrib.auth import authenticate
>>> authenticate(username='ea87', password='666monkeysAndDogs777')
<User: ea87>
>>> print(authenticate(username='ea87', password='wrong password'))
None
>>> from django.contrib.auth.hashers import check_password
>>> check_password('666monkeysAndDogs777', my_user.password)
True
>>> exit()
接下来,我在settings.py中添加了以下内容:
PASSWORD_HASHERS = (
'django.contrib.auth.hashers.BCryptSHA256PasswordHasher',
'django.contrib.auth.hashers.BCryptPasswordHasher',
'django.contrib.auth.hashers.PBKDF2PasswordHasher',
'django.contrib.auth.hashers.PBKDF2SHA1PasswordHasher',
'django.contrib.auth.hashers.SHA1PasswordHasher',
'django.contrib.auth.hashers.MD5PasswordHasher',
'django.contrib.auth.hashers.CryptPasswordHasher',
)
(django186p34)~/django_projects/dj1$ python manage.py shell
Python 3.4.3 (v3.4.3:9b73f1c3e601, Feb 23 2015, 02:52:03)
[GCC 4.2.1 (Apple Inc. build 5666) (dot 3)] on darwin
Type "help", "copyright", "credits" or "license" for more information.
(InteractiveConsole)
>>> from django.conf import settings
>>> print(settings.PASSWORD_HASHERS)
('django.contrib.auth.hashers.BCryptSHA256PasswordHasher',
'django.contrib.auth.hashers.BCryptPasswordHasher',
'django.contrib.auth.hashers.PBKDF2PasswordHasher',
'django.contrib.auth.hashers.PBKDF2SHA1PasswordHasher',
'django.contrib.auth.hashers.SHA1PasswordHasher',
'django.contrib.auth.hashers.MD5PasswordHasher',
'django.contrib.auth.hashers.CryptPasswordHasher')
注意元组开头的bcrypt哈希器。
>>> from django.contrib.auth.models import User
>>> user = User.objects.get(username='ea87')
>>> user
<User: ea87>
>>> user.password
'pbkdf2_sha256$20000$DS20ZOCWTBFN$AFfzg3iC24Pkj5UtEu3O+J8KOVBQvaLVx43D0Wsr4PY='
>>> user.set_password('666monkeysAndDogs777')
>>> user.password
'bcrypt_sha256$$2b$12$QeWvpi7hQ8cPQBF0LzD4C.89R81AV4PxK0kjVXG73fkLoQxYBundW'
你可以看到密码已经更改为bcrypt版本。
<算法>$<迭代次数>$<盐>$<哈希值>
格式,而是如你在答案末尾所看到的(至少我的php哈希值是这样加密的 -> 导入到django中时没有"_sha256"! :)) - Ilja