How to store password on gae properly when someone registers?

Question

For example:

username:zjm1126
password:11

I store the password to the datastore on gae. When I see the data view at /_ah/admin, I can see the password of all people that have registered.

Is it safe to do so? If not, how to store it properly?

And the check_password method is:

user=MyUser.get_by_key_name(self.request.get('username'))
if user.password == self.request.get('password'):
    session['user.key']=str(user.key())
else:
    raise Exception('error 404')

score 10 · Accepted Answer · answered Jun 11 '10 at 11:50

10

You should never store a password in plain text.

Use a ir-reversable data hashing algorithm, like sha or md5

Here is how you can create a hash in python:

from hashlib import sha256
from random import random
random_key = random()
sha256('%s%s%s'%('YOUR SECRET KEY',random_key,password))

You should also store the random key and hash the user supplied password similarly.

answered Jun 11 '10 at 11:50

lprsd

84,407
47
135
168

4

md5 should not be recommended. – systempuntoout Jun 11 '10 at 13:10
md5 is okay for small databases, I doubt you will have enough users to clash – DanDan Jun 11 '10 at 15:13
@DanDan Why do you say that MD5 is okay but only for small databases? Database size can't be a reason to use a cryptographic algorithm or another. – cpinamtz Oct 09 '19 at 07:35

score 2 · Answer 2 · edited May 23 '17 at 11:46

2

There is nothing app-engine specific or new about this question that hasn't been answered 10 times before on SO. Search Stack Overflow for store password and read the first 5 questions. That should give you a good foundation in the subject.

edited May 23 '17 at 11:46

Community

1
1

answered Jun 11 '10 at 15:42

Peter Recore

14,037
4
42
62

score 0 · Answer 3 · edited May 23 '17 at 12:09

There are numerous posts on stackoverflow about how to use various algorithms to product the integrity of passwords. Algorithms you should look into are SHA-256/SHA-512 in conjunction with a long randomly generated salt (which would also be stored in the database) or bcrypt. I won't go into the discussion of why one is better than the other here because that discussion is already taking place in other questions.

How to store password on gae properly when someone registers?

3 Answers3