我编写了一个python脚本,将用户输入与数据库查询进行比较,然后允许或不允许登录。我将把我的问题分解,以便更容易理解:
出于安全原因,我的数据库自动加密了密码。
脚本查询数据库,然后将加密的密码存储在python中
如果用户必须输入正确的密码才能登录,并且用户必须输入正常(未加密)的密码,那么如何在python中解密密码?
澄清:
我的程序加密和解密的密码和唯一的id的用户已经双重安全。
我希望一切尽可能安全。不久前我就开始使用面向对象的python,所以请不要太苛刻。
我是非专业的,但它会达到生产!
信息
我使用mysql作为数据库,python3.7作为脚本,flask作为会话。
# Imports
from passlib.context import CryptContext
import mysql.connector
import json
from pprint import pprint
# Config file loaded as a json
with open("database_connect.json") as config:
config = json.load(config)
config = config[0]
try:
# Json is argued as a kwarg
cnx = mysql.connector.connect(**config)
cursor = cnx.cursor()
# Query is made
cursor.execute("SELECT first,id,pwd,uid FROM user")
args = cursor.fetchone()
# Any integer queries have the string function mapped to them
args = tuple(map(lambda i: str(i), args))
except:
print("Connection error!")
finally:
cnx.close()
# Passlib encryption method
passlib_context = CryptContext(
schemes=["pbkdf2_sha256"],
default="pbkdf2_sha256",
pbkdf2_sha256__default_rounds=300000)
# Base class for all users
class default:
priviliges = {
"Ban": False,
"Kick": False,
"Broadcast": False,
"Iplookup": False }
# Instantiating the default class
def __init__(self, name, uniqueid, pwd, usernameid):
self.name = name
self.__pwd = passlib_context.hash(pwd)
self.__uniqueid = passlib_context.hash(uniqueid)
self.usernameid = usernameid
# Encryption method for users
def encrypt_method(self):
encrypt_data = [self.__pwd, self.__uniqueid]
return encrypt_data
class decrypt():
# Instantiating the decryption class
def __init__(self, attempted_pwd, hashpwd):
self.__attempted_pwd = attempted_pwd
self.__hashpwd = hashpwd
# Decryption method for decryption class
def decrypt_method(self):
decrypt_data = passlib_context.verify(self.__attempted_pwd, self.__hashpwd)
if decrypt_data is False:
allow_login = False
elif decrypt_data is True:
allow_login = True
return allow_login
# Information fetched from the database in tuple form, used as an argument
user = default(*args)
# Attempt corresponds to user input. The first argument is the attempted password.
attempt = decrypt("",user.encrypt_method()[0])
print(attempt.decrypt_method())
暂无答案!
目前还没有任何答案,快来回答吧!