Skip to content


Subversion checkout URL

You can clone with HTTPS or Subversion.

Download ZIP
Browse files

Fixed #15627 -- Use constant time comparison for password checks. Tha…

…nks to hvdklauw for the report and patch.

git-svn-id: bcc190cf-cafb-0310-a4f2-bffc1f526a37
  • Loading branch information...
commit a0878b5f95b5fc5bac02d818e864cab507b73564 1 parent 7ab5ce6
@freakboy3742 freakboy3742 authored
Showing with 2 additions and 1 deletion.
  1. +2 −1  django/contrib/auth/
3  django/contrib/auth/
@@ -10,6 +10,7 @@
from django.utils.encoding import smart_str
from django.utils.hashcompat import md5_constructor, sha_constructor
from django.utils.translation import ugettext_lazy as _
+from django.utils.crypto import constant_time_compare
UNUSABLE_PASSWORD = '!' # This will never be a valid hash
@@ -39,7 +40,7 @@ def check_password(raw_password, enc_password):
encryption formats behind the scenes.
algo, salt, hsh = enc_password.split('$')
- return hsh == get_hexdigest(algo, salt, raw_password)
+ return constant_time_compare(hsh, get_hexdigest(algo, salt, raw_password))
def update_last_login(sender, user, **kwargs):
Please sign in to comment.
Something went wrong with that request. Please try again.