Hi,
I have two seperate sources capable of generating user passwords (one is a
legacy system but unfortunately it will not go away for a while).
The legacy system uses Argon2id while the new Django-based system is fixed
to version Argon2i for both encoding and decoding.
In my opinion the decoding `verify` function should be agnostic to the version
of the algorithm and set the type on the part of the string like:
```
def verify(self, password, encoded):
argon2 =3D self._load_library()
algorithm, rest =3D encoded.split('$', 1)
assert algorithm =3D=3D self.algorithm
alg_identifier, _ =3D rest.split('$', 1)
alg_short =3D alg_identifier.split('argon2')[1]
type =3D getattr(argon2.low_level.Type, alg_short.upper())
try:
return argon2.low_level.verify_secret(
force_bytes('$' + rest),
force_bytes(password),
type=3Dtype,
)
except argon2.exceptions.VerificationError:
return False
```
What do you think?
Till
--
You received this message because you are subscribed to the Google Groups
"Django developers (Contributions to Django itself)" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to django-developers+unsubscr...@googlegroups.com.
To post to this group, send email to django-developers@googlegroups.com.
Visit this group at https://groups.google.com/group/django-developers.
To view this discussion on the web visit
https://groups.google.com/d/msgid/django-developers/24cd5fc3-ab3e-442c-a7b3-e28e2d1e4dfb%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.
