Django
发布时间:2022-04-10 发布网站:大佬教程 code.js-code.com
大佬教程收集整理的这篇文章主要介绍了Django 自带密码加密,自定密码加密方式 及自定义验证方式,大佬教程大佬觉得挺不错的,现在分享给大家,也给大家做个参考。
<div id="article_content" class="article_content csdn-tracking-statistics" style="overflow: hidden;" data-mod="popu_519" data-dsm="post">
在django1.6中,默认的加密方式是pbkdf_sha256,具体算法不表,一直以来用django的自带用户验证都十分顺手,今天有需求,需要修改默认加密方式为md5,具体方法为:
在setTings.py中加入
passworD_HASHERS=(
- String">'myproject.hashers.MymD5passwordHasher',
- String">'django.contrib.auth.hashers.MD5passwordHasher',
- String">'django.contrib.auth.hashers.PBKDF2passwordHasher',
- String">'django.contrib.auth.hashers.PBKDF2SHA1passwordHasher',
- String">'django.contrib.auth.hashers.bCryptSHA256passwordHasher',
- String">'django.contrib.auth.hashers.bCryptpasswordHasher',
- String">'django.contrib.auth.hashers.SHA1passwordHasher',
- String">'django.contrib.auth.hashers.CryptpasswordHasher',
- )
passworD_HASHERS = (
'myproject.hashers.MymD5passwordHasher','django.contrib.auth.hashers.MD5passwordHasher','django.contrib.auth.hashers.PBKDF2passwordHasher','django.contrib.auth.hashers.PBKDF2SHA1passwordHasher','django.contrib.auth.hashers.bCryptSHA256passwordHasher','django.contrib.auth.hashers.bCryptpasswordHasher','django.contrib.auth.hashers.SHA1passwordHasher','django.contrib.auth.hashers.CryptpasswordHasher',)</pre>
django会默认使用第一条加密方式。
这个是我自定义的加密方式,就是基本的md5,而django的MD5passwordHasher是加盐的。
以下是我的自定义hashers.py:
<div class="dp-highlighter bg_python">
<div class="bar">
<div class="tools">[python] <a class="Viewsource" title="view plain" onclick="dp.sh.Toolbar.Command('Viewsource',this);return false;" href="#">copy
<div style="position: absolute; left: 277px; top: 713px; width: 16px; height: 16px; z-index: 99;"><object id="ZeroClipboardMovie_2" width="16" height="16" align="middle" bgcolor="#ffffff" data="http://static.blog.csdn.net/scripts/ZeroClipboard/ZeroClipboard.swf" type="application/x-shockwave-flash">
<span class="tracking-ad" data-mod="popu_169"> <a class="Printsource" title="print" onclick="dp.sh.Toolbar.Command('Printsource',this);return false;" href="#">?
django.contrib.auth.hashersBasepasswordHasher,MD5passwordHasher
- django.contrib.auth.hashers@H_994_26@mask_hash
- hashlib
- @H_994_26@mymD5passwordHasher(MD5passwordHasher):
- algorithm=String">"mymd5"
- encode(,password,salt):
- password
- hash=hashlib.md5(password).hexdigest().upper()
- hash
- verify(,encoded):
- encoded_2=.encode(password,String">'')
- encoded.upper()==encoded_2.upper()
- safe_sumMary(,encoded):
- orderedDict([
- (_(String">'algorithm'),algorithm),
- (_(String">'salt'),String">''),
- (_(String">'hash'),mask_hash(hash)),
- ])
passwordHasher,MD5passwordHasher
from django.contrib.auth.hashers import mask_hash
import hashlib
class MymD5passwordHasher(MD5passwordHasher):
algorithm = "mymd5"
def encode(self,salt):
assert password is not None
hash = hashlib.md5(password).hexdigest().upper()
return hash
def verify(self,encoded):
encoded_2 = self.encode(password,'')
return encoded.upper() == encoded_2.upper()
def safe_sumMary(self,encoded):
return orderedDict([
(_('algorithm'),(_('salt'),''),(_('hash'),])
之后可以在数据库中看到,密码确实使用了自定义的加密方式。
然而仅仅修改这些,在配合django的authenticate验证时无法进行。
经过一些查找,发现需要在自定义authenticate。以下为方法:
在setTings.py中加入以下:
<div class="dp-highlighter bg_python">
<div class="bar">
<div class="tools">[python] <a class="Viewsource" title="view plain" onclick="dp.sh.Toolbar.Command('Viewsource',this);return false;" href="#">copy
<div style="position: absolute; left: 277px; top: 1296px; width: 16px; height: 16px; z-index: 99;"><object id="ZeroClipboardMovie_3" width="16" height="16" align="middle" bgcolor="#ffffff" data="http://static.blog.csdn.net/scripts/ZeroClipboard/ZeroClipboard.swf" type="application/x-shockwave-flash">
<span class="tracking-ad" data-mod="popu_169"> <a class="Printsource" title="print" onclick="dp.sh.Toolbar.Command('Printsource',this);return false;" href="#">?
AUTHENTICATION_BACKENDS=(
- String">'chicken.myBACkend.MyBACkend',
- )
BACKENDS = (
'chicken.myBACkend.MyBACkend',)
以下代码为自定义的myBACkend.py
<div class="dp-highlighter bg_python">
<div class="bar">
<div class="tools">[python] <a class="Viewsource" title="view plain" onclick="dp.sh.Toolbar.Command('Viewsource',this);return false;" href="#">copy
<div style="position: absolute; left: 277px; top: 1441px; width: 16px; height: 16px; z-index: 99;"><object id="ZeroClipboardMovie_4" width="16" height="16" align="middle" bgcolor="#ffffff" data="http://static.blog.csdn.net/scripts/ZeroClipboard/ZeroClipboard.swf" type="application/x-shockwave-flash">
<span class="tracking-ad" data-mod="popu_169"> <a class="Printsource" title="print" onclick="dp.sh.Toolbar.Command('Printsource',this);return false;" href="#">?
hashlib
- pro@H_994_26@models
- @H_994_26@myBACkend(object):
- authenticate(,username=,password=):
- :
- user=models.M_User.objects.get(username=userName)
- user
- Exception:
- String">'nouser'
- hashlib.md5(password).hexdigest().upper()==user.password:
- user
- get_user(,user_id):
- :
- @H_994_26@models.M_User.objects.get(id=user_id)
- Exception:
class MyBACkend(object):
def authenticate(self,username=None,password=NonE):
try:
user = models.M_User.objects.get(username=userName)
print user
except Exception:
print 'no user'
return None
if hashlib.md5(password).hexdigest().upper() == user.password:
return user
return None
def get_user(self,user_id):
try:
return models.M_User.objects.get(id=user_id)
except Exception:
return None
之后验证成功。
当然经过这些修改后最终的安全性比起django自带的降低很多,但是需求就是这样的,必须满足。
完成需求的过程中查找了不少资料,最后还是在django文档中找到的答案,文档还是很全全面的,以后通读还是感觉有必要的。
</div>
考虑到Django有用户验证模块,证明它已具备跨平台的加密模块。
<p style="list-style: none; margin-top: 0px; margin-bottom: 0px; padding-top: 8px; padding-bottom: 8px; font-size: 14px; line-height: 26px; word-wrap: break-word; color: #444444; font-family: Simsun;"> 首先,引入模块:
BACkground: #ffbb77; width: 620px;" border="0" cellspacing="1" celLPADding="1" align="center">
</tr>
<tr>
<td id="copy3502" class="copyclass" style="color: #000000; list-style: none; margin: 0px; padding: 10px;" colspan="2" valign="top" bgcolor="#FFFFFF" height="auto">
<p style="list-style: none; margin-top: 0px; margin-bottom: 0px; padding-top: 8px; padding-bottom: 8px; font-size: 14px; word-wrap: break-word;">
</td>
</tr>
</table>
<p style="list-style: none; margin-top: 0px; margin-bottom: 0px; padding-top: 8px; padding-bottom: 8px; font-size: 14px; line-height: 26px; word-wrap: break-word; color: #444444; font-family: Simsun;">
这样就可以利用django自带的模块生成一组密码了,这个函数还有一个特点在于每次生成的密码还不一样:
<table style="color: #444444; font-family: Simsun; font-size: 15px; line-height: 26px; BACkground: #ffbb77; width: 620px;" border="0" cellspacing="1" celLPADding="1" align="center">
</tr>
<tr>
<td id="copy3089" class="copyclass" style="color: #000000; list-style: none; margin: 0px; padding: 10px;" colspan="2" valign="top" bgcolor="#FFFFFF" height="auto">
<p style="list-style: none; margin-top: 0px; margin-bottom: 0px; padding-top: 8px; padding-bottom: 8px; font-size: 14px; word-wrap: break-word;">
</td>
</tr>
</table>
<p style="list-style: none; margin-top: 0px; margin-bottom: 0px; padding-top: 8px; padding-bottom: 8px; font-size: 14px; line-height: 26px; word-wrap: break-word; color: #444444; font-family: Simsun;">
既然每次生成的密文都不一样,如何验证用户提交过来的明文与密文匹配呢?这就靠check_password去做了,check_password使用非常简单,只需要告诉它明文和密文它就会返回false or True验证结果
<table style="color: #444444; font-family: Simsun; font-size: 15px; line-height: 26px; BACkground: #ffbb77; width: 620px;" border="0" cellspacing="1" celLPADding="1" align="center">
</tr>
<tr>
<td id="copy9726" class="copyclass" style="color: #000000; list-style: none; margin: 0px; padding: 10px;" colspan="2" valign="top" bgcolor="#FFFFFF" height="auto">
<p style="list-style: none; margin-top: 0px; margin-bottom: 0px; padding-top: 8px; padding-bottom: 8px; font-size: 14px; word-wrap: break-word;">
</td>
</tr>
</table>
<p style="list-style: none; margin-top: 0px; margin-bottom: 0px; padding-top: 8px; padding-bottom: 8px; font-size: 14px; line-height: 26px; word-wrap: break-word; color: #444444; font-family: Simsun;">
如果你不想每次都生成不同的密文,可以把make_password的第二个函数给一个固定的字符串,比如:
<table style="color: #444444; font-family: Simsun; font-size: 15px; line-height: 26px; BACkground: #ffbb77; width: 620px;" border="0" cellspacing="1" celLPADding="1" align="center">
</tr>
<tr>
<td id="copy2782" class="copyclass" style="color: #000000; list-style: none; margin: 0px; padding: 10px;" colspan="2" valign="top" bgcolor="#FFFFFF" height="auto">
</tr>
</table>
<p style="list-style: none; margin-top: 0px; margin-bottom: 0px; padding-top: 8px; padding-bottom: 8px; font-size: 14px; line-height: 26px; word-wrap: break-word; color: #444444; font-family: Simsun;">
只要是任意字符串就可以,并且可以多个。但不能为空,如:
<table style="color: #444444; font-family: Simsun; font-size: 15px; line-height: 26px; BACkground: #ffbb77; width: 620px;" border="0" cellspacing="1" celLPADding="1" align="center">
</tr>
<tr>
<td id="copy3223" class="copyclass" style="color: #000000; list-style: none; margin: 0px; padding: 10px;" colspan="2" valign="top" bgcolor="#FFFFFF" height="auto">
<p style="list-style: none; margin-top: 0px; margin-bottom: 0px; padding-top: 8px; padding-bottom: 8px; font-size: 14px; word-wrap: break-word;">
</td>
</tr>
</table>
<p style="list-style: none; margin-top: 0px; margin-bottom: 0px; padding-top: 8px; padding-bottom: 8px; font-size: 14px; line-height: 26px; word-wrap: break-word; color: #444444; font-family: Simsun;">
为空的字符串就相当于:
1
<table style="color: #444444; font-family: Simsun; font-size: 15px; line-height: 26px; BACkground: #ffbb77; width: 620px;" border="0" cellspacing="1" celLPADding="1" align="center">
</tr>
<tr>
<td id="copy1264" class="copyclass" style="color: #000000; list-style: none; margin: 0px; padding: 10px;" colspan="2" valign="top" bgcolor="#FFFFFF" height="auto">
make_password(text,'pbkdf2_sha256')</td>
</tr>
</table>
<p style="list-style: none; margin-top: 0px; margin-bottom: 0px; padding-top: 8px; padding-bottom: 8px; font-size: 14px; line-height: 26px; word-wrap: break-word; color: #444444; font-family: Simsun;">
至于make_password第三个参数是表示生成密文的一种方式,根据文档给出的大概有这几种:
<table style="color: #444444; font-family: Simsun; font-size: 15px; line-height: 26px; BACkground: #ffbb77; width: 620px;" border="0" cellspacing="1" celLPADding="1" align="center">
</tr>
<tr>
<td id="copy6708" class="copyclass" style="color: #000000; list-style: none; margin: 0px; padding: 10px;" colspan="2" valign="top" bgcolor="#FFFFFF" height="auto">
<p style="list-style: none; margin-top: 0px; margin-bottom: 0px; padding-top: 8px; padding-bottom: 8px; font-size: 14px; word-wrap: break-word;">
pbkdf2_sha256
pbkdf2_sha1
bcrypt_sha256
bcrypt
sha1
unsalted_md5
crypt
</td>
</tr>
</table>
<p style="list-style: none; margin-top: 0px; margin-bottom: 0px; padding-top: 8px; padding-bottom: 8px; font-size: 14px; line-height: 26px; word-wrap: break-word; color: #444444; font-family: Simsun;">
以上例子我使用了第一种加密方式pbkdf2_sha256,crypt和bcrypt都需要另外单独安装模块,unsalted_md5就是常见的md5加密,如果对加密哈希算法不是很了解,那么就使用django最新的哈希算法pbkdf2_sha256就好
大佬总结
以上是大佬教程为你收集整理的Django 自带密码加密,自定密码加密方式 及自定义验证方式全部内容,希望文章能够帮你解决Django 自带密码加密,自定密码加密方式 及自定义验证方式所遇到的程序开发问题。
如果觉得大佬教程网站内容还不错,欢迎将大佬教程推荐给程序员好友。
本图文内容来源于网友网络收集整理提供,作为学习参考使用,版权属于原作者。
如您有任何意见或建议可联系处理。小编QQ:384754419,请注明来意。
标签: