Add more secure password storage via salt value and hmac

2026-08-12 12:00:37 +08:00 · 2012-07-18 13:27:30 -04:00
parent 1c606a242a
commit 68dd972bfa
8 changed files with 43 additions and 10 deletions
@@ -77,7 +77,9 @@ def _check_http_auth():
    except UserNotFoundError:
        return False

-    rv = _security.pwd_context.verify(auth.password, user.password)
+    rv = utils.verify_password(auth.password, user.password,
+                               salt=_security.password_salt,
+                               use_hmac=_security.password_hmac)

    if rv:
        identity_changed.send(current_app._get_current_object(),