search

nshafer / django-hashid-field

Django Model Field that uses Hashids to obscure the value
MIT License
370 stars 40 forks source link

Salt only uses first 43 characters #51

Closed coofercat closed 3 years ago

coofercat commented 4 years ago

This appears to be an issue upstream (which I raised there: https://github.com/davidaurelio/hashids-python/issues/43), but may be worth knowing (and maybe documenting) here too. Advice such as:

HASHID_FIELD_SALT = "a long and secure salt value that is not the same as SECRET_KEY"

...isn't strictly true. Only the first 43 characters of whatever salt you supply are actually used. It remains to be seen if this is a bug, or undocumented feature (or me misunderstanding), but may save someone some time if they're trying things like salt=settings.HASHID_FIELD_SALT + 'something_else' in an attempt to have multiple salts in their application.

nshafer commented 4 years ago

Thanks for letting me know. I'll keep an eye on upstream, and perhaps add a note about it for now in the docs.