Custom password hashes¶
RestAuth understands various hashing algorithms supported by Django, as well as
a few custom hashing algorithms. You can configure the algorithms supported by
RestAuth with the PASSWORD_HASHERS
setting. This setting is a
standard Django setting,
but RestAuth supports a few additional hashers by default.
You can implement your own hashing algorithm if you
intend to import data from a system not supported by RestAuth. If your hasher is
the first hasher listed in PASSWORD_HASHERS
, RestAuth will also store
hashes using this algorithm. This is useful if you plan to later export data to
such a system.
Available hash functions¶
RestAuth supports all hashers shipping with Django. RestAuth also already implements a few other hashers.
-
class
RestAuth.common.hashers.
Apr1Hasher
[source]¶ Returns hashes using a modified md5 algorithm used by the Apache webserver to store passwords. Hashes generated using this function are identical to the ones generated with
htpasswd -m
.
-
class
RestAuth.common.hashers.
Drupal7Hasher
[source]¶ Hasher that understands hashes as created by Drupal7.
If you want to import hashes created by Drupal7, just prefix them with the string
drupal7
. For example, in PHP do:$exported_hash = "drupal7" . $rawhash;
This class is only a slightly modified version of the
PhpassHasher
. This class uses Sha512 and hashes start with$S$
instead of$P$
. Like Drupal7, it does support reading normal$P$
hashes as well.
-
class
RestAuth.common.hashers.
MediaWikiHasher
[source]¶ Returns hashes as stored in a MediaWiki user database. If salt is a string, the hash returned is the md5 hash of a concatenation of the salt, a dash (“-”), and the md5 hash of the password, otherwise it is identical to a plain md5 hash of the password.
Please see the official documentation for exact details.
-
class
RestAuth.common.hashers.
PhpassHasher
[source]¶ Hasher that understands hashes as created by phpass, the “portable PHP password hashing framework”. This system is most prominently used by WordPress and phpBB3.
If you want to import hashes created by phpass, just prefix them with the string
phpass
. For example, in PHP, do:$exported_hash = "phpass" . $rawhash;
Implement your own hash functions¶
We use the password hashing mechanisms shipping with Django. If you want to implement your own hasher, you may want to read up on how Django stores passwords first. The official documentation is a little lacking on how to implement your own hashers, so here are a few additional instructions:
- Your class should inherit from
django.contrib.auth.hashers.BasePasswordHasher
. - You must implement the
algorithm
property as well as theverify()
,encode()
andsafe_summery()
methods. - If you need to generate salts in a specific way, also implement the
salt()
method.
Here is the documentation for the baseclass shipping with django:
-
class
django.contrib.auth.hashers.
BasePasswordHasher
[source]¶ Abstract base class for password hashers
When creating your own hasher, you need to override algorithm, verify(), encode() and safe_summary().
PasswordHasher objects are immutable.
-
encode
(password, salt)[source]¶ Creates an encoded database value
The result is normally formatted as “algorithm$salt$hash” and must be fewer than 128 characters.
-
Example¶
For examples on how to implement your own hashers, please look at the source
code of the very simple RestAuth.common.hashers.Sha512Hasher
.