How can I store hashed password on database with Django?

Question

I want to make the textbox input starred while typing in the password, also I want the password to be saved in the database as a hashed password.

The View

class UserCreate(CreateView):
    model = ModelUser
    fields = ['first_name', 'password', 'username', 'dob', 'email', 'unit', 'house', 'road', 'suburb', 'state', 'postcode', 'country', 'id_type', 'id_no']

URLConf

url(r'^add_user/$', views.UserCreate.as_view()),

The Model

class ModelUser(AbstractUser):
    client_id = models.IntegerField(null=True)  #id_client in voipswitch database
    user_type = models.CharField(max_length=15, default='client')
    dob = models.DateField(blank=True, null=True)
    phone = models.CharField(max_length=20, default=0)
    unit = models.CharField(max_length=20, blank=True, null=True)
    house = models.CharField(max_length=20, blank=True, null=True)
    road = models.CharField(max_length=25, blank=True, null=True)
    suburb = models.CharField(max_length=25, blank=True, null=True)
    state = models.CharField(max_length=25, blank=True, null=True)
    postcode = models.CharField(max_length=15, blank=True, null=True)
    country = models.CharField(max_length=30, blank=True, null=True)
    id_type = models.CharField(max_length=25, blank=True, null=True)
    id_no = models.CharField(max_length=30, blank=True, null=True)
    reg_time = models.DateTimeField(editable=False, default=datetime.datetime.today())

    def __unicode__(self):
        return self.phone

This question is already answered here

Nitin Arora
– Nitin Arora

2014-08-02 21:34:48 +00:00
Commented Aug 2, 2014 at 21:34 — Nitin Arora
– Nitin Arora, Commented Aug 2, 2014 at 21:34

metakermit · Accepted Answer · 2015-08-04 17:24:22Z

1

So, using a CharField for the password

password = models.CharField(max_length=255, blank=True)

allows you to use a PasswordInput in the form that makes the UI "star" it.

password = forms.PasswordInput()

Then to store the password hash into the database under password, you need to make sure it's a string, not bytes. Django's internal hashers mentioned by others will return strings by default. If you use something like scrypt (I'm assuming Python3), be sure to decode it before storing it to the DB:

import scrypt, os, base64

def generate_password(length=255):
    chars = string.ascii_letters + string.digits
    return ''.join(choice(chars) for _ in range(length))

user.password = base64.b64encode(scrypt.encrypt(
    generate_password(datalength), user.password
))
user.save()

And later to verify it...

try:
    scrypt.decrypt(base64.b64decode(user.password), 'guessed_password')
    return True
except scrypt.error:
    return False

Note - an encoding issue with scrypt I encountered is tracked here.

edited Aug 4, 2015 at 17:24

answered Aug 1, 2015 at 16:01

metakermit

22.6k16 gold badges90 silver badges96 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

Mohammed Shareef C Over a year ago

Why not make_password in django?

metakermit Over a year ago

@MohammedShareefC you can use that too and in most cases it's simpler, although scrypt is not available there and some crypto nerds prefer scrypt to defend against some types of attacks – crypto.stackexchange.com/questions/8159/…

Collectives™ on Stack Overflow

How can I store hashed password on database with Django?

1 Answer 1

2 Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

2 Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related