p15693087
/
django
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Clarified how contrib.auth picks a password hasher for verification.

This commit is contained in:
Adam Johnson 2022-01-13 19:46:18 +00:00 committed by GitHub
parent 827bc07047
commit 652c68ffee
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 10 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
docs/topics/auth/passwords.txt
View File

@ -48,12 +48,16 @@ you're not sure, you probably don't. If you do, please read on:
Django chooses the algorithm to use by consulting the
:setting:`PASSWORD_HASHERS` setting. This is a list of hashing algorithm
classes that this Django installation supports. The first entry in this list
(that is, ``settings.PASSWORD_HASHERS[0]``) will be used to store passwords,
and all the other entries are valid hashers that can be used to check existing
passwords. This means that if you want to use a different algorithm, you'll
need to modify :setting:`PASSWORD_HASHERS` to list your preferred algorithm
first in the list.
classes that this Django installation supports.
For storing passwords, Django will use the first hasher in
:setting:`PASSWORD_HASHERS`. To store new passwords with a different algorithm,
put your preferred algorithm first in :setting:`PASSWORD_HASHERS`.
For verifying passwords, Django will find the hasher in the list that matches
the algorithm name in the stored password. If a stored password names an
algorithm not found in :setting:`PASSWORD_HASHERS`, trying to verify it will
raise ``ValueError``.
The default for :setting:`PASSWORD_HASHERS` is::