Flask-Bcrypt compatibility? Invalid password when login

[ivymichael]

Hi

I disabled the Flask-Security registration form, and use my previous registration form, here is how I store the password based on user submitted form data:

...
hashed_password = bcrypt.generate_password_hash(form.password.data).decode('utf-8')
user = User(username=form.username.data,email=form.email.data, password=hashed_password)
db.session.add(user)
...

However, when try to login by using Flask-Security built-in login form, it says invalid password,
then I checked the documentation, I found it might be related to the HMAC idea here,
is it possible that somehow I generate the hashed password by Flask-Bcrypt and finally can be accepted by Flask-Security login backend? I have very limited cryptography knowledge and stuck this for whole night : (

or the mentioned flask_security.utils.encrypt_password in #143 is still available and also the only way to manage this?

Thank you!

[nk9]

The answer is yes: use encrypt_password. This will ensure that the hashed password you store at registration uses the same salt + HMAC method Flask-Security uses to hash the password at login. So your users will actually be able to sign in!