Django 意外地只存储密码哈希，而不存储算法参数

Question

我有一个 Django 应用程序，它在本地按预期运行。它在迁移中创建一个用户:

superuser = User.objects.create_superuser(
  username=username, email=email, password=password
)
superuser.save()

它在本地创建了一个完全符合我预期的密码结构:

MySQL [XXXX]> select * from auth_user;
+----+---------------------------------------------------------------------------+----------------------------+--------------+----------+------------+-----------+-------------------+----------+-----------+----------------------------+
| id | password                                                                  | last_login                 | is_superuser | username | first_name | last_name | email             | is_staff | is_active | date_joined                |
+----+---------------------------------------------------------------------------+----------------------------+--------------+----------+------------+-----------+-------------------+----------+-----------+----------------------------+
|  5 | argon2$argon2i$v=19$m=512,t=2,p=2$SXXXXXXXXXX2eVFl$KZdVItv/XXXXXXXXXXXuRg | 2020-05-15 16:26:01.713174 |            1 | internal |            |           | XXX@XXX.org |        1 |         1 | 2020-05-15 16:25:12.438746 |
+----+---------------------------------------------------------------------------+----------------------------+--------------+----------+------------+-----------+-------------------+----------+-----------+----------------------------+

在生产中它做了一些非常奇怪的事情，存储了散列而不是任何算法数据:

MySQL [XXXX]> select * from auth_user;
+----+-------------------------------------------+------------+--------------+----------+------------+-----------+-------------------+----------+-----------+----------------------------+
| id | password                                  | last_login | is_superuser | username | first_name | last_name | email             | is_staff | is_active | date_joined|
+----+-------------------------------------------+------------+--------------+----------+------------+-----------+-------------------+----------+-----------+----------------------------+
|  1 | !rbx7XXXXXXXXXXXXXXXXu7o84FNI3tZcQc5Lgkqt | NULL       |            1 | internal |            |           | XXX@XXX.org |        1 |         1 | 2020-05-15 09:43:49.955879|
+----+-------------------------------------------+------------+--------------+----------+------------+-----------+-------------------+----------+-----------+----------------------------+

我已验证相同的 docker 镜像校验和用于本地测试和远程测试。我的需求文件是:

#
# This file is autogenerated by pip-compile
# To update, run:
#
#    pip-compile requirements.in
#
argon2-cffi==19.2.0       # via django
boto==2.49.0              # via django-ses
brotli==1.0.7             # via whitenoise
certifi==2020.4.5.1       # via requests, sentry-sdk
cffi==1.14.0              # via argon2-cffi
chardet==3.0.4            # via requests
django-environ==0.4.5     # via -r requirements.in
django-ipware==2.1.0      # via django-structlog
django-prometheus==1.1.0  # via -r requirements.in
django-ses==0.8.14        # via -r requirements.in
django-structlog==1.5.2   # via -r requirements.in
django-zxcvbn-password==2.1.0  # via -r requirements.in
django[argon2]==2.2.3     # via -r requirements.in, django-structlog, djangorestframework
djangorestframework==3.11.0  # via -r requirements.in
future==0.18.2            # via django-ses
gunicorn==20.0.4          # via -r requirements.in
idna==2.9                 # via requests
incuna-mail==4.0.0        # via -r requirements.in
mysqlclient==1.4.6        # via -r requirements.in
prometheus-client==0.7.1  # via django-prometheus
pycparser==2.20           # via cffi
pytz==2019.3              # via django, django-ses
requests==2.23.0          # via -r requirements.in
sentry-sdk==0.14.3        # via -r requirements.in
six==1.14.0               # via -r requirements.in, argon2-cffi, structlog
sqlparse==0.3.1           # via django
structlog==20.1.0         # via django-structlog
urllib3==1.25.9           # via requests, sentry-sdk
whitenoise[brotli]==5.0.1  # via -r requirements.in
zxcvbn==4.4.28            # via django-zxcvbn-password

# The following packages are considered to be unsafe in a requirements file:
# setuptools

这可能是什么原因造成的？

Answer 1

这是由于配置中提供的空白密码导致设置了无法使用的密码。 User.objects.create_superuser 在提供空字符串时设置无法使用的密码。文档说:

If no password is provided, set_unusable_password() will be called.

https://docs.djangoproject.com/en/3.0/ref/contrib/auth/#django.contrib.auth.models.UserManager.create_user

然而，空字符串似乎被视为“无密码”(这出乎意料，但考虑到 Python 对空字符串的错误处理，这并不奇怪)。服务配置中存在错误，导致向其传递空密码。

出现意外的不同格式的原因是无法使用的密码似乎没有使用相同的哈希函数结构。