5

I have a python library which I wrote for something else. So I import that to use in Django, problem I am facing is how to get the password.

mycustom_lib_function(username, password)

username I can pass in through request.user

But, I am not sure how to get the password. Can someone help me? Thanks.

4 Answers 4

17

The password in User is hashed, and so you cannot get it. Ask the user.

3
  • Thanks. Are you saying the users have to manually input the password? I looked at User API, and not quite sure how I can get it through. Commented Mar 5, 2012 at 18:18
  • I meant exactly what I wrote. Commented Mar 5, 2012 at 18:22
  • Thanks. But I can't ask for password all the time. This function is used for some click events. So having them to enter the password 100 times for each of the 100 requests before clicking is pretty ... insane. Commented Mar 5, 2012 at 18:26
6

You technically can store the password as plain-text but its not right from a security stand poit, see this answer, it is highly not recommended! django.contrib.auth.hashers has some good tools to use for passwords, see the official Django docs.

If you have an idea what the plain-text password could be, i.e. I have a globally stored default password in one of my applications that is stored in plain-text, as in the example below. To check if a user has their password set to the default one, you can use the check_password function that will return True if the plain-text matches the encoded password:

from django.contrib.auth.hashers import check_password
from django.contrib.auth.models import User
u = User.objects.all().first()
if check_password('the default password', u.password):
    print 'user password matches default password'
else:
    print 'user a set custom password'

Also see is_password_usable, and make_password functions.

5

Your function mycustom_lib_function should not be using a plaintext password. After a user authenticates with your application, you have a User object (from django.contrib.auth.models) that contains a hashed password:

>>> user.username
u'myusername'
>>> user.password
u'sha1$98ffc$b5fd085b8bc1c05fd241dfc97230631926141fe7'

The actual password typed into your form is not stored in plaintext, as standard web security advises you not to store plaintext values of passwords after authentication.
Note that you could check the above hash by performing:

>>> from hashlib import sha1
>>> password = 'weak_password'
>>> _, salt, hashpw = user.password.split('$')
>>> sha1(salt+password).hexdigest() == hashpw
True

Now if your application wraps into another application that you do not control that needs a password to do certain actions, you can possibly consider storing their password in plaintext (or slightly better encrypting it), but django.contrib.auth will not do this for you. It would be better if you set up an OAuth type credential system, which does exactly this functionality without necessitating users reveal their password to the intermediate site.

If its an application that you do control, I would drop the requirement for password to be passed to it.

5
  • I can't control it. The library is for remote repository control (hg, git), so username and passwords are needed to invoke it. which are basically the same as django login). So think of a function that does "clone repository". The function takes in the url, username, password, and clone to local disk. Yes. The function takes in the plaintext password. So we can't decrypt this password through Django? THanks Commented Mar 5, 2012 at 19:02
  • Well, I designed the library. So right now I take username and password, which are plaintext as you've observed. But I don't think I can pass in the hash into those remote repositories to authenticate. Commented Mar 5, 2012 at 19:08
  • @anotheruser Yes, you can't 'decrypt' a hashed password through django. (A hash is a one-way function not really encryption). You could possibly save the password of the user in plaintext in the DB, when they create a user account. See: stackoverflow.com/questions/44109/… You should make it very clear to the users that you are storing their passwords in plaintext. Another possibility is you keep track of who has permissions within your app, and create an account for user django in the git/hg repos that does actions for the user.
    – dr jimbob
    Commented Mar 5, 2012 at 19:12
  • Thanks jimbob. We agree that at some point we will have to support OAUth and OpenID. At the moment we just extend the User class, with a small custom function, which returns the login info (pass in request.user, check if it has the permission to call our custom lib, and if so, give in a global credential). Thanks. Commented Mar 5, 2012 at 21:49
  • This is not true anymore. In Django 4 password is composed by 4 fields - <algorithm>$<iterations>$<salt>$<hash>, and nothing prevents this from changing again in the future. Much better using the 'check_password' Django function. Commented Jan 18, 2022 at 16:16
1

You can't get the password of the user but you can check whether the given value is correct password or not.

from django.contrib.auth.hashers import check_password
user = User.objects.get(id = user_id) #get the correct user using mail or id
if check_password('my_old_password',user.password):
   #update the password here
1
  • Your answer could be improved with additional supporting information. Please edit to add further details, such as citations or documentation, so that others can confirm that your answer is correct. You can find more information on how to write good answers in the help center.
    – Ersain
    Commented Jun 29, 2022 at 4:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.