Possibility to change password encryption

Hello!

I’ve made the horrible mistake of not setting SECURITY_PASSWORD_HASH to something other than plain text and was hoping there was a way to either change all the password to a hashed format on the fly?

It would be pretty cool in the future if there was a method for this kind of stuff 😃

[robin-wittler]

On 11/17/2013 08:59 PM, Matt Wright wrote:

It all depends on how you add users to your database. If you have set |SECURITY_REGISTERABLE = True|, and are only adding users via the built-in registration form, then you’ll be fine. If you’re adding users by any other means you must encrypt the password using |flask_security.utils.encrypt_password| before saving the user record in your database.

Yes - looks like i stumbled over this behavior. I’ve just followed the tutorial and created a user with the @app.before_first_request and thought that the “user_datastore.create_user” call would do everything which is necessary to have a secure (and encrypted) password in the database.

Later i looked at the code and saw that this call will do only things with Roles. Then i used encrypt_password in the “user_datastore.create_user” call and the password was stored encrypted in the database.

From my point of view this behavior is unexpected. I think the datastore.create_user call (or better the self._prepare_create_user_args call) should also do the encryption stuff.

At least (IMHO) you should think about pointing out this behavior clearly in your tutorial - or extend self._prepare_create_user_args to do encryption.

Anyway - thank you for flask-security and keep up your good work. 😉

— Reply to this email directly or view it on GitHub https://github.com/mattupstate/flask-security/issues/143#issuecomment-28662247.

[mattupstate]

It all depends on how you add users to your database. If you have set SECURITY_REGISTERABLE = True, and are only adding users via the built-in registration form, then you’ll be fine. If you’re adding users by any other means you must encrypt the password using flask_security.utils.encrypt_password before saving the user record in your database.