Merge pull request #2362 from GNS3/feature/use-bcrypt

Use bcrypt direcrtly instead of passlib

gns3server/services/authentication.py

@@ -17,7 +17,7 @@
 
 from jose import JWTError, jwt
 from datetime import datetime, timedelta
-from passlib.context import CryptContext
+import bcrypt
 
 from typing import Optional
 from fastapi import HTTPException, status
@@ -29,8 +29,6 @@ import logging
 
 log = logging.getLogger(__name__)
 
-pwd_context = CryptContext(schemes=["bcrypt"], deprecated="auto")
-
 DEFAULT_JWT_SECRET_KEY = "efd08eccec3bd0a1be2e086670e5efa90969c68d07e072d7354a76cea5e33d4e"
 
 
@@ -38,11 +36,13 @@ class AuthService:
 
     def hash_password(self, password: str) -> str:
 
-        return pwd_context.hash(password)
+        salt = bcrypt.gensalt()
+        hashed_password = bcrypt.hashpw(password=password.encode('utf-8'), salt=salt)
+        return hashed_password.decode('utf-8')
 
     def verify_password(self, password, hashed_password) -> bool:
 
-        return pwd_context.verify(password, hashed_password)
+        return bcrypt.checkpw(password=password.encode('utf-8'), hashed_password=hashed_password.encode('utf-8'))
 
     def create_access_token(self, username, secret_key: str = None, expires_in: int = 0) -> str:
 

requirements.txt

@@ -13,7 +13,7 @@ py-cpuinfo==9.0.0
 sqlalchemy==2.0.28
 aiosqlite==0.20.0
 alembic==1.12.1
-passlib[bcrypt]==1.7.4
+bcrypt==4.1.2
 python-jose==3.3.0
 email-validator==2.1.1
 watchfiles==0.21.0