CODEWITHSUNDEEP
django
John Eipe
John Eipe

Reputation: 11226

Understanding User class in django

I create a user in my view.py using this simple code.

if not errors:
    user = User.objects.create_user(username, email, password)
    user.save()

Except for the validation, there is nothing that I do to the username and password values before creating the object.

But I find this in the User class in Django API. I don't know how to use the help text. If it is help text what does it print? How do I find the default values of algo, salt and hexdigest? 

password = models.CharField(_('password'), max_length=128, help_text=_("Use '[algo]$[salt]$[hexdigest]' or use the <a href=\"password/\">change password form</a>."))

Upvotes: 0

Views: 233

Answers (3)

Michał Modzelewski
Michał Modzelewski

Reputation: 1320

The help text is basicly just code for the message that shows up in the django admin, when editing a User object. It's meant to explain to someone looking at the edit form, why the password field has something like sha1$12345$1234567890abcdef1234567890abcdef12345678 instead of the password that was set for that user. The reason is, of course that the password is hashed for security, and that representation holds all the information required to verify a user-typed password later.

The admin user edit form has a special page for editing passwords. If you want to edit the users password in your code use the set_password method of the User object, the check_password method is for verifying a supplied password.

The documentation for make_password has more information about the algorithms Django uses and can use. The default for Django <1.3 was sha1, Django 1.4 changed the default to PBKDF2. The default value for salt is a random string (it's there so that two identical passwords don't look the same in the database). Hexdigest is the value of the password string and the salt string hashed with the hashing algorithm. You can read the details in the code on github.

Upvotes: 0

vartec
vartec

Reputation: 134631

create_user will automatically generate password hash and it will create user in the database (thus you don't need that user.save())

See docs on creating users.

Upvotes: 1

Hoff
Hoff

Reputation: 39866

"If it is help text what does it print?" -> it prints exactly this: Use '[algo]$[salt]$[hexdigest]'

when you create a user, it will automatically call make_password(password[, salt, hashers])

which: Creates a hashed password in the format used by this application. It takes one mandatory argument: the password in plain-text. Optionally, you can provide a salt and a hashing algorithm to use, if you don't want to use the defaults (first entry of PASSWORD_HASHERS setting). Currently supported algorithms are: 'pbkdf2_sha256', 'pbkdf2_sha1', 'bcrypt' (see Using bcrypt with Django), 'sha1', 'md5', 'unsalted_md5'

are you facing any problems with this?

Upvotes: 1

Related Questions