Add more secure password storage via salt value and hmac

2026-08-11 11:18:40 +08:00 · 2012-07-18 13:27:30 -04:00
parent 1c606a242a
commit 68dd972bfa
8 changed files with 43 additions and 10 deletions
@@ -113,7 +113,10 @@ class UserDatastore(object):
        pw = kwargs['password']

        if not pwd_context.identify(pw):
-            kwargs['password'] = pwd_context.encrypt(pw)
+            pwd_hash = utils.encrypt_password(pw,
+                                              salt=_security.password_salt,
+                                              use_hmac=_security.password_hmac)
+            kwargs['password'] = pwd_hash

        kwargs['remember_token'] = utils.get_remember_token(kwargs['email'],
                                                            kwargs['password'])