werkzeug.security

module documentation

(source)

Undocumented

Function	`check_password_hash`	Check a password against a given salted and hashed password value. In order to support unsalted legacy passwords this method supports plain text passwords, md5 and sha1 hashes (both salted and unsalted).
Function	`gen_salt`	Generate a random string of SALT_CHARS with specified ``length``.
Function	`generate_password_hash`	Hash a password with the given method and salt with a string of the given length. The format of the string returned includes the method that was used so that :func:`check_password_hash` can check the hash.
Function	`safe_join`	Safely join zero or more untrusted path components to a base directory to avoid escaping the base directory.
Constant	`DEFAULT_PBKDF2_ITERATIONS`	Undocumented
Constant	`SALT_CHARS`	Undocumented
Function	`_hash_internal`	Internal password hash helper. Supports plaintext without salt, unsalted and salted passwords. In case salted passwords are used hmac is used.
Variable	`_os_alt_seps`	Undocumented

def check_password_hash(pwhash: str, password: str) -> bool: (source) ¶

Check a password against a given salted and hashed password value. In order to support unsalted legacy passwords this method supports plain text passwords, md5 and sha1 hashes (both salted and unsalted). Returns `True` if the password matched, `False` otherwise. :param pwhash: a hashed string like returned by :func:`generate_password_hash`. :param password: the plaintext password to compare against the hash.

def gen_salt(length: int) -> str: (source) ¶

Generate a random string of SALT_CHARS with specified ``length``.

def generate_password_hash(password: str, method: str = 'pbkdf2:sha256', salt_length: int = 16) -> str: (source) ¶

Hash a password with the given method and salt with a string of the given length. The format of the string returned includes the method that was used so that :func:`check_password_hash` can check the hash. The format for the hashed string looks like this:: method$salt$hash This method can **not** generate unsalted passwords but it is possible to set param method='plain' in order to enforce plaintext passwords. If a salt is used, hmac is used internally to salt the password. If PBKDF2 is wanted it can be enabled by setting the method to ``pbkdf2:method:iterations`` where iterations is optional:: pbkdf2:sha256:80000$salt$hash pbkdf2:sha256$salt$hash :param password: the password to hash. :param method: the hash method to use (one that hashlib supports). Can optionally be in the format ``pbkdf2:method:iterations`` to enable PBKDF2. :param salt_length: the length of the salt in letters.

def safe_join(directory: str, *pathnames: str) -> t.Optional[str]: (source) ¶

Safely join zero or more untrusted path components to a base directory to avoid escaping the base directory. :param directory: The trusted base directory. :param pathnames: The untrusted path components relative to the base directory. :return: A safe path, otherwise ``None``.

DEFAULT_PBKDF2_ITERATIONS: int = (source) ¶

Undocumented

Value

SALT_CHARS: str = (source) ¶

Undocumented

Value

'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789'

def _hash_internal(method: str, salt: str, password: str) -> t.Tuple[str, str]: (source) ¶

Internal password hash helper. Supports plaintext without salt, unsalted and salted passwords. In case salted passwords are used hmac is used.

_os_alt_seps: t.List[str] = (source) ¶

Undocumented