Add a work around bcrypt maximum password length #45
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
By default, the bcrypt algorithm has a maximum password length of 72 bytes and ignores any bytes beyond that. A common workaround is to hash the given password using a cryptographic hash (such as `sha256`), take its hexdigest to prevent NULL byte problems, and hash the result with bcrypt. If the `BCRYPT_HANDLE_LONG_PASSWORDS` configuration value is set to `True`, the workaround described above will be enabled. WARNING: enabling this option on a project that is already using Flask-Bcrypt will break password checking.
|
Thank you, this is fantastic! I agree with your first point I think. Although I'm open to adding the option if people find it useful. As to your second point it's been so long since those tests were written I can't honestly recall how they work. However running them twice is probably fine. |
|
Thank you for the merge! Another thing to consider is that this work around can provide less entropy in some cases: http://stackoverflow.com/a/16597402 |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Hello,
The bcrypt algorithm has a maximum password length of 72 bytes, and ignores any bytes beyond that.
This pull request adds a workaround via the
BCRYPT_HANDLE_LONG_PASSWORDSconfiguration value. When set toTrue, a given password is hashed using sha256 before being fed to bcrypt.Note: this option should not be set to
Trueon projects that are already using Flask-Bcrypt, or password checking will break (as we are hashing the sha256 of the password instead of the password itself).I would like to discuss about a few points:
BasicTestCase, tests are now running twice: once with the option set toFalse, and once with the option set toTrue. I'm not sure if this is really necessary.