Question

我有一个Users表，其中定义了password列：

password | text | not null

这样定义了一个SQLAlchemy模型：

password = db.Column(PasswordType(schemes=['bcrypt'], max_length=128), nullable=False)

我可以使用此模型成功插入一行：

user = Users(first_name='James', last_name='Bond', password='aaa')
db.session.add(user)
db.session.commit()

但是在选择行时，我无法比较密码：

user = db.session.query(Users).join(ContactDetails).\
            filter(ContactDetails.email == 'james.bond@gmail.com').first()
assert user.password == 'aaa'

这会导致以下错误：

_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
../../../../.virtualenvs/amazon_sales/lib/python2.7/site-packages/sqlalchemy_utils/types/password.py:60: in __eq__
    valid, new = self.context.verify_and_update(value, self.hash)
../../../../.virtualenvs/amazon_sales/lib/python2.7/site-packages/passlib/context.py:2417: in verify_and_update
    record = self._get_or_identify_record(hash, scheme, category)
../../../../.virtualenvs/amazon_sales/lib/python2.7/site-packages/passlib/context.py:2026: in _get_or_identify_record
    return self._identify_record(hash, category)
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

self = <passlib.context._CryptConfig object at 0x10f5e7090>, hash = '\\x2432622431322457475a794c4e4a5973704e4f7750444b322e3766302e336c58365778506e7050767a2e6f394d317748716650717174796a6e4d3475'
category = None, required = True

    def identify_record(self, hash, category, required=True):
        """internal helper to identify appropriate custom handler for hash"""
        # NOTE: this is part of the critical path shared by
        #       all of CryptContext's PasswordHash methods,
        #       hence all the caching and error checking.
        # FIXME: if multiple hashes could match (e.g. lmhash vs nthash)
        #        this will only return first match. might want to do something
        #        about this in future, but for now only hashes with
        #        unique identifiers will work properly in a CryptContext.
        # XXX: if all handlers have a unique prefix (e.g. all are MCF / LDAP),
        #      could use dict-lookup to speed up this search.
        if not isinstance(hash, unicode_or_bytes_types):
            raise ExpectedStringError(hash, "hash")
        # type check of category - handled by _get_record_list()
        for record in self._get_record_list(category):
            if record.identify(hash):
                return record
        if not required:
            return None
        elif not self.schemes:
            raise KeyError("no crypt algorithms supported")
        else:
>           raise ValueError("hash could not be identified")
E           ValueError: hash could not be identified

../../../../.virtualenvs/amazon_sales/lib/python2.7/site-packages/passlib/context.py:1131: ValueError

Answer 1

使用bcrypt的目的是不将明文密码存储在数据库中。而是存储密码的哈希值（如果您不清楚，则应阅读PasswordType和OWASP Authentication Cheat Sheet的文档并确保您理解它。）

您正在做的是通过SQLAlchemy魔术存储bcrypt密码，并将其与明文密码进行比较：

assert user.password == 'aaa'

虽然您应该密码并将结果与存储在数据库中的内容进行比较。看看bcrypt.hashpw。

密码比较返回错误

1 个答案: