Fixed #36226 -- Accepted str or bytes for password and salt in password hashers.

[roelzkie15]

Trac ticket number

ticket-36226

Branch description

Ensure that all hashers' .encode() method is flexible to accept str or bytes value. The returned hashed/encoded value is also verifiable regardless of whether the password provided in the hasher's verify() method is in str or bytes type.

• PBKDF2PasswordHasher
• MD5PasswordHasher
• PBKDF2PasswordHasher
• PBKDF2SHA1PasswordHasher
• ScryptPasswordHasher
• BCryptPasswordHasher
• BCryptSHA256PasswordHasher
• Argon2PasswordHasher

Related ticket (inactive?): #19235

Edit: Add support for accepting salt as str or bytes when encoding and verifying passwords.

Checklist

• This PR targets the main branch.
• The commit message is written in past tense, mentions the ticket number, and ends with a period.
• I have checked the "Has patch" ticket flag in the Trac system.
• I have added or updated relevant tests.
• I have added or updated relevant docs, including release notes if applicable.
• I have attached screenshots in both light and dark modes for any UI changes.

[sarahboyce]

Thank you for the PR
I have a couple of comments
Can you also make @CodemanRichard a co-author of the commit please 👍

[roelzkie15]

Thank you for the PR I have a couple of comments Can you also make @CodemanRichard a co-author of the commit please 👍

Done ✅. Though I'm not sure how to do the co-authoring in git, but I rebased the commit with a message attributing also to @CodemanRichard :)

[roelzkie15]

Ready for another round of review.

[roelzkie15]

This is what it looks like for this test:

Test for MD5PasswordHasher:

To encode: password=password;salt=SCLshnum1QdOPjfEEWAcBy
Encoded:  md5$SCLshnum1QdOPjfEEWAcBy$364c38f9a4c4ab9bc7393c4bc480f890
Verify with: password=password;password_to_verify=password;salt=SCLshnum1QdOPjfEEWAcBy is success
Verify with: password=password;password_to_verify=b'password';salt=SCLshnum1QdOPjfEEWAcBy is success

To encode: password=password;salt=b'qoFwuwsBF3b8a5cPwJgqhC'
Encoded:  md5$qoFwuwsBF3b8a5cPwJgqhC$8f46dd5cb579cebd4a93120ddc2a4b3a
Verify with: password=password;password_to_verify=password;salt=b'qoFwuwsBF3b8a5cPwJgqhC' is success
Verify with: password=password;password_to_verify=b'password';salt=b'qoFwuwsBF3b8a5cPwJgqhC' is success

To encode: password=b'password';salt=wlNz9RItlfoiYdKfoSBOO3
Encoded:  md5$wlNz9RItlfoiYdKfoSBOO3$d6f7ec580b18062e04de68f3297b3d12
Verify with: password=b'password';password_to_verify=password;salt=wlNz9RItlfoiYdKfoSBOO3 is success
Verify with: password=b'password';password_to_verify=b'password';salt=wlNz9RItlfoiYdKfoSBOO3 is success

To encode: password=b'password';salt=b'jBzICbb1HwDzUDzS3tx6Bu'
Encoded:  md5$jBzICbb1HwDzUDzS3tx6Bu$b2442bede21b438fc80563cb466a9d49
Verify with: password=b'password';password_to_verify=password;salt=b'jBzICbb1HwDzUDzS3tx6Bu' is success
Verify with: password=b'password';password_to_verify=b'password';salt=b'jBzICbb1HwDzUDzS3tx6Bu' is success

Test for PBKDF2PasswordHasher:

To encode: password=password;salt=68W37zwTE5pKOcqseVklLC
Encoded:  pbkdf2_sha256$1200000$68W37zwTE5pKOcqseVklLC$MBhmV1d5iryOiCjQcWi7Nb7X0XT+m6vKDsymccVlqpM=
Verify with: password=password;password_to_verify=password;salt=68W37zwTE5pKOcqseVklLC is success
Verify with: password=password;password_to_verify=b'password';salt=68W37zwTE5pKOcqseVklLC is success

To encode: password=password;salt=b'6fIKJ1jWQPiwBSSoEAnw0W'
Encoded:  pbkdf2_sha256$1200000$6fIKJ1jWQPiwBSSoEAnw0W$LD8WPFYTPc6V4cfmILv05CcZvB9RbUSPgLjx6Qx0ClY=
Verify with: password=password;password_to_verify=password;salt=b'6fIKJ1jWQPiwBSSoEAnw0W' is success
Verify with: password=password;password_to_verify=b'password';salt=b'6fIKJ1jWQPiwBSSoEAnw0W' is success

To encode: password=b'password';salt=Qdt5iKOFYDe1eFObgTexLO
Encoded:  pbkdf2_sha256$1200000$Qdt5iKOFYDe1eFObgTexLO$tGj/IaDqeAE+TKcGW/OCBceOumj6iID4IZbnHtdXzSI=
Verify with: password=b'password';password_to_verify=password;salt=Qdt5iKOFYDe1eFObgTexLO is success
Verify with: password=b'password';password_to_verify=b'password';salt=Qdt5iKOFYDe1eFObgTexLO is success

To encode: password=b'password';salt=b'R6jSD0ptcjcwaPTcgZ9kAg'
Encoded:  pbkdf2_sha256$1200000$R6jSD0ptcjcwaPTcgZ9kAg$h2akXiTNugCiucdSl0SAzJG4S8lFmpnosud/ut1DB3I=
Verify with: password=b'password';password_to_verify=password;salt=b'R6jSD0ptcjcwaPTcgZ9kAg' is success
Verify with: password=b'password';password_to_verify=b'password';salt=b'R6jSD0ptcjcwaPTcgZ9kAg' is success

Test for PBKDF2SHA1PasswordHasher:

To encode: password=password;salt=p6Y8jqat8vqgoh5XsVhgTV
Encoded:  pbkdf2_sha1$1200000$p6Y8jqat8vqgoh5XsVhgTV$lx6fypf1cwvqxNy9zy2faUHAuhE=
Verify with: password=password;password_to_verify=password;salt=p6Y8jqat8vqgoh5XsVhgTV is success
Verify with: password=password;password_to_verify=b'password';salt=p6Y8jqat8vqgoh5XsVhgTV is success

To encode: password=password;salt=b'Aaummmx29Xy2RBFUdTzY2y'
Encoded:  pbkdf2_sha1$1200000$Aaummmx29Xy2RBFUdTzY2y$cqYFGuF0Kvkmml1o9mxuPT961Zw=
Verify with: password=password;password_to_verify=password;salt=b'Aaummmx29Xy2RBFUdTzY2y' is success
Verify with: password=password;password_to_verify=b'password';salt=b'Aaummmx29Xy2RBFUdTzY2y' is success

To encode: password=b'password';salt=dkVCevG20RkUdk0aJ656py
Encoded:  pbkdf2_sha1$1200000$dkVCevG20RkUdk0aJ656py$kZfe6AKWU7JJxSZUT4uj7UQggLY=
Verify with: password=b'password';password_to_verify=password;salt=dkVCevG20RkUdk0aJ656py is success
Verify with: password=b'password';password_to_verify=b'password';salt=dkVCevG20RkUdk0aJ656py is success

To encode: password=b'password';salt=b'q0bwA0XZroUAKJm1s9s7Dk'
Encoded:  pbkdf2_sha1$1200000$q0bwA0XZroUAKJm1s9s7Dk$vjEa4yrqqCLytQC6j5Tydf6foQA=
Verify with: password=b'password';password_to_verify=password;salt=b'q0bwA0XZroUAKJm1s9s7Dk' is success
Verify with: password=b'password';password_to_verify=b'password';salt=b'q0bwA0XZroUAKJm1s9s7Dk' is success

Test for ScryptPasswordHasher:

To encode: password=password;salt=sYXlPqEHNQvskWSMaWIlS8
Encoded:  scrypt$16384$sYXlPqEHNQvskWSMaWIlS8$8$5$sYYZF/dpBW21ER94JkXwV0mb1/Rz9AFkM7MvuX0qCjcB2/9idHL++aXJo+YxpwNLlwZ7hWT8RaQLH83OD1ZijA==
Verify with: password=password;password_to_verify=password;salt=sYXlPqEHNQvskWSMaWIlS8 is success
Verify with: password=password;password_to_verify=b'password';salt=sYXlPqEHNQvskWSMaWIlS8 is success

To encode: password=password;salt=b'o43uySb61LeYIblYPO4CT5'
Encoded:  scrypt$16384$o43uySb61LeYIblYPO4CT5$8$5$FA4BinLdamShrOvqXMt7ZR+gfR1SCn2sLyg67pRIyoQng3dO+VaB2Lz+hLHZwSnP406yMvfH4/Z8k57z1Auq0w==
Verify with: password=password;password_to_verify=password;salt=b'o43uySb61LeYIblYPO4CT5' is success
Verify with: password=password;password_to_verify=b'password';salt=b'o43uySb61LeYIblYPO4CT5' is success

To encode: password=b'password';salt=iCQcGN1WGw0ZDRidroaswm
Encoded:  scrypt$16384$iCQcGN1WGw0ZDRidroaswm$8$5$3H4cNdjrb+bhD+TlfyveYNrBFDqchBQA6aX1v/3lUeCU27D911KU1DjRt616zjQkVVVGo/lXGOkGBs8YzACrgA==
Verify with: password=b'password';password_to_verify=password;salt=iCQcGN1WGw0ZDRidroaswm is success
Verify with: password=b'password';password_to_verify=b'password';salt=iCQcGN1WGw0ZDRidroaswm is success

To encode: password=b'password';salt=b'RQFbBNmeP6x0E6g5fxrI2i'
Encoded:  scrypt$16384$RQFbBNmeP6x0E6g5fxrI2i$8$5$Tsf3IoWGbG+qW/pCFXE51E887VEIa5coVN+mY8EsNu2A/qBsgcgzOO4lOxBZXKiits7U62ztY430Y14FehYOvQ==
Verify with: password=b'password';password_to_verify=password;salt=b'RQFbBNmeP6x0E6g5fxrI2i' is success
Verify with: password=b'password';password_to_verify=b'password';salt=b'RQFbBNmeP6x0E6g5fxrI2i' is success

[ontowhee]

Done ✅. Though I'm not sure how to do the co-authoring in git, but I rebased the commit with a message attributing also to @CodemanRichard :)

Hello! Here is the documentation on how to add a co-author. You would want to use their author's email address instead of their github profile link. Look through the git log of the previous PR to find the email in the commits. Hope this helps.

[roelzkie15]

Done ✅. Though I'm not sure how to do the co-authoring in git, but I rebased the commit with a message attributing also to @CodemanRichard :)

Hello! Here is the documentation on how to add a co-author. You would want to use their author's email address instead of their github profile link. Look through the git log of the previous PR to find the email in the commits. Hope this helps.

Awsomeness. I managed to modify the commit with a co-author. Very helpful, thanks!

[sarahboyce]

Thank you! Welcome onboard 🚢