CryptContext always sets relaxed=True - so never get ValueError failures for bad options.
Created originally on Bitbucket by Anonymous
Py3.7, passlib 1.7.1.
So:
cc=CryptContext(schemes=["bcrypt"])
cc.update({“bcrypt__rounds”: 1})
PasslibHashWarning: bcrypt: min_desired_rounds (3) is too low, must be at least 4
Great - but that’s just a log message - You can’t send in ‘relaxed’ to update or CryptContext. This seems to be because in:
def _create_record(handler, category=None, deprecated=False, **settings):
# create custom handler if needed.
try:
# XXX: relaxed=True is mostly here to retain backwards-compat behavior.
# could make this optional flag in future.
subcls = handler.using(relaxed=True, **settings)
It always passes in ‘True’.
This seems to violate what was stated in passlib 1.6 release notes:
Starting with this release, providing invalid values to
PasswordHash.encrypt
will result in aValueError
. However, most hashes now accept an optionalrelaxed=True
keyword, which causes Passlib to try and correct invalid values, and if successful, issue aPasslibHashWarning
instead. These warnings can then be filtered if desired.
While true - one can pass into the hash function itself - this makes CryptContext behave very differently than using specific hashes.