should salt be random generated everytime instead of hardcoded in the config file?

[wangluyi1982]

@mattupstate , salt is currently defined in the flask app config, which is used for all then user encryption. Is this behavior expected? salt should be random generated. According to https://crackstation.net/hashing-security.htm, a short or hardcoded salt is not recommended. Is there any defined feature for this?

[mattupstate]

@wangluyi1982 passlib automatically generates a unique salt per password. The "salt" in this case is used when the password is HMACed. This is similar to how the itsdangerous library uses the term "salt", described here.