RestAuth understands various hashing algorithms supported by Django, as well as a few custom hashing algorithms. You can configure the algorithms supported by RestAuth with the PASSWORD_HASHERS setting. This setting is a standard Django setting, but RestAuth supports a few additional hashers by default.
You can implement your own hashing algorithm if you intend to import data from a system not supported by RestAuth. If your hasher is the first hasher listed in PASSWORD_HASHERS, RestAuth will also store hashes using this algorithm. This is useful if you plan to later export data to such a system.
RestAuth supports all hashers shipping with Django. RestAuth also already implements a few other hashers.
Returns hashes using a modified md5 algorithm used by the Apache webserver to store passwords. Hashes generated using this function are identical to the ones generated with htpasswd -m.
Hasher that understands hashes as created by Drupal7.
If you want to import hashes created by Drupal7, just prefix them with the string drupal7. For example, in PHP do:
$exported_hash = "drupal7" . $rawhash;
This class is only a slightly modified version of the PhpassHasher. This class uses Sha512 and hashes start with $S$ instead of $P$. Like Drupal7, it does support reading normal $P$ hashes as well.
Returns hashes as stored in a MediaWiki user database. If salt is a string, the hash returned is the md5 hash of a concatenation of the salt, a dash (“-”), and the md5 hash of the password, otherwise it is identical to a plain md5 hash of the password.
Please see the official documentation for exact details.
Hasher that understands hashes as created by phpass, the “portable PHP password hashing framework”. This system is most prominently used by WordPress and phpBB3.
If you want to import hashes created by phpass, just prefix them with the string phpass. For example, in PHP, do:
$exported_hash = "phpass" . $rawhash;
We use the password hashing mechanisms shipping with Django. If you want to implement your own hasher, you may want to read up on how Django stores passwords first. The official documentation is a little lacking on how to implement your own hashers, so here are a few additional instructions:
Here is the documentation for the baseclass shipping with django:
Abstract base class for password hashers
When creating your own hasher, you need to override algorithm, verify(), encode() and safe_summary().
PasswordHasher objects are immutable.
Creates an encoded database value
The result is normally formatted as “algorithm$salt$hash” and must be fewer than 128 characters.
For examples on how to implement your own hashers, please look at the source code of the very simple RestAuth.common.hashers.Sha512Hasher.