tronosfera/backup_service
1
0
Fork 0
mirror of https://github.com/TronoSfera/backup_service.git synced 2026-05-18 10:03:32 +03:00
Code Issues Projects Releases Packages Wiki Activity Actions

Merge pull request #8 from TronoSfera/codex/fix-bcrypt-password-length-error-pf2dee

Browse source 
Handle bcrypt long-password hashing safely
This commit is contained in:
TronoSfera 2026-01-19 11:46:08 +03:00 committed by GitHub
commit e141d2d7b8
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 16 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

18
server/auth.py
View file

@ -36,15 +36,29 @@ ACCESS_TOKEN_EXPIRE_MINUTES = int(os.getenv("ACCESS_TOKEN_EXPIRE_MINUTES", "60")
# Password hashing context # Password hashing context
pwd_context = CryptContext(schemes=["bcrypt_sha256", "bcrypt"], deprecated="auto") pwd_context = CryptContext(schemes=["bcrypt_sha256", "bcrypt"], deprecated="auto")
def _normalize_bcrypt_password(password: str) -> str | bytes:
"""Normalize passwords to avoid bcrypt's 72-byte length limit.
Some bcrypt backends raise a ValueError for passwords longer than 72 bytes.
Truncate to 72 bytes to match typical bcrypt behavior instead of crashing.
"""
encoded = password.encode("utf-8")
if len(encoded) <= 72:
return password
return encoded[:72]
oauth2_scheme = OAuth2PasswordBearer(tokenUrl="/api/login", auto_error=False) oauth2_scheme = OAuth2PasswordBearer(tokenUrl="/api/login", auto_error=False)
def hash_password(password: str) -> str: def hash_password(password: str) -> str:
return pwd_context.hash(password) normalized = _normalize_bcrypt_password(password)
return pwd_context.hash(normalized)
def verify_password(plain_password: str, hashed_password: str) -> bool: def verify_password(plain_password: str, hashed_password: str) -> bool:
return pwd_context.verify(plain_password, hashed_password) normalized = _normalize_bcrypt_password(plain_password)
return pwd_context.verify(normalized, hashed_password)
def create_access_token(data: dict, expires_delta: Optional[datetime.timedelta] = None) -> str: def create_access_token(data: dict, expires_delta: Optional[datetime.timedelta] = None) -> str: