search

jpvanhal / flask-basicauth

HTTP basic access authentication for Flask.
https://flask-basicauth.readthedocs.io/
Other
85 stars 27 forks source link

Allow hashed passwords #23

Closed ashokdelphia closed 4 years ago

ashokdelphia commented 5 years ago

I'd like to use simple basic auth for a service, but without storing the plain-text password on the host.

This allows setting a PBKDF2-derived hash value in place of the password, with some optional configuration parameters to choose the algorithm, salt and number of rounds.

I believe this also avoids the variable-time password comparison described in #3 / #21, when configured to use a hashed password.

ashokdelphia commented 5 years ago

I'll need to come up with a different way to handle this to support python 2.6 and 3.3

ashokdelphia commented 4 years ago

I doubt I'll ever find time to devote to making this work on really old versions of Python.

If you drop support for versions past their end-of-life, then this may be useful to bring back.