bread-and-pepper/django-userena — Issue #121: Support for bcrypt Migration
Author: ndarville
Created: 2011-11-13 02:18:14+00:00
State: open

I am sure you already know about [bcrypt](http://codahale.com/how-to-safely-store-a-password/)—probably the [Django app](https://github.com/dwaiter/django-bcrypt/), too. To everyone else not familiar, it is, at its core, a (much) securer way to store users’ passwords.

`django-bcrypt` is very easy to install (unless you run Windows). The only issue is with pre-existing users who already have a password in the database converted by Django’s default `SHA1`. In order to migrate these passwords to `bcrypt`, people can either include `BCRYPT_MIGRATE = True` in `settings.py` and run a manual `check_password()` on all users manually—or they can write a manual check in [their log-in view](https://github.com/bread-and-pepper/django-userena/blob/master/userena/views.py#L281) as detailed [here](http://code.playfire.com/django-bcrypt/):

```python
def login(request):
if request.method == 'POST':
form = AuthenticationForm(request.POST)

if form.is_valid():
user = form.get_user()

if user.password.startswith('sha1'):
user.set_password(form['password'])
user.save()

# [etc]
```

The latter is preferable. I don’t know how you want to implement this specifically, so I refrained from doing a pull request, as it was guaranteed to get completely refactored to your own style anyway.