From cb1e779ceb461fd1a5ad9e7659316ac4d3775a5f Mon Sep 17 00:00:00 2001 From: Tim Graham Date: Tue, 22 Sep 2015 19:30:31 -0400 Subject: [PATCH] Refs #24115 -- Added docs for password updates on bcrypt rounds change. --- docs/topics/auth/passwords.txt | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/docs/topics/auth/passwords.txt b/docs/topics/auth/passwords.txt index b4362ed3aa..346aa6fcae 100644 --- a/docs/topics/auth/passwords.txt +++ b/docs/topics/auth/passwords.txt @@ -191,8 +191,13 @@ can switch to new (and better) storage algorithms as they get invented. However, Django can only upgrade passwords that use algorithms mentioned in :setting:`PASSWORD_HASHERS`, so as you upgrade to new systems you should make sure never to *remove* entries from this list. If you do, users using -unmentioned algorithms won't be able to upgrade. Passwords will be upgraded -when changing the PBKDF2 iteration count. +unmentioned algorithms won't be able to upgrade. Hashed passwords will be +updated when increasing (or decreasing) the number of PBKDF2 iterations or +bcrypt rounds. + +.. versionchanged:: 1.9 + + Passwords updates when changing the number of bcrypt rounds was added. .. _sha1: https://en.wikipedia.org/wiki/SHA1 .. _pbkdf2: https://en.wikipedia.org/wiki/PBKDF2 @@ -200,7 +205,6 @@ when changing the PBKDF2 iteration count. .. _bcrypt: https://en.wikipedia.org/wiki/Bcrypt .. _`bcrypt library`: https://pypi.python.org/pypi/bcrypt/ - Manually managing a user's password ===================================