Python Django prevent password reuse - django

Question

I'm currently trying to prevent users from using their old passwords (configurable, like say last 5 passwords)
I have the following Infos:
User passwort in cleartext from the form during validation (form.cleaned_data['new_password1'])
Their current hashed Password (pwd_before_change)
Their last x passwords also hashed (pws)
Funnily enough my code works for the current password, but not for my old ones:
pwd_before_change = user_to_change.password
....
old_pws = Passwords.objects.filter(username=user_to_change).order_by('-password_changed')[:allowed_reuse].values_list('password', flat=True)
....
if old_pws:
for pws in old_pws:
if check_password(form.cleaned_data['new_password1'], pws) or \
check_password(form.cleaned_data['new_password1'], pwd_before_change)
messages.error(request,
f'You are not allowed a password which was already used in the last '
f'{allowed_reuse + 1} iterations')
return render(request, 'registration/password_change.html', {
'form': form
})
Any ideas what the issue may be? (additional info, I'm using Argon2).
Do I really need to encode the cleartext password again with all possible "salt" in the old passwords and check? (this would make the method depending on the hasher function which would not be ideal + I thought the check passwort function was exactly for scenarios like this?)

Answer 1

Ok, not sure what exactly was the issue, but I split up the "if" and now it works:
logger_user.info("User {} is attempting a password change".format(username))
if form.is_valid():
# Get the allowed Password counter from the settings, reduce by 1 as the current password is also checked!
allowed_reuse = settings.PASSWORD_REUSE - 1
logger_user.info(f"Allowed PWs: {allowed_reuse +1 }")
if check_password(form.cleaned_data['new_password1'], pwd_before_change):
messages.error(request, f'You are not allowed to re-use your current password')
return render(request, 'registration/password_change.html', {
'form': form
})
# Retrieve the last x passwords according to the Password Reuse Setting
old_pws = Passwords.objects.filter(username=user_to_change).order_by('-password_changed')[:allowed_reuse].values_list('password', flat=True)
# Compare the new Passwort with the old passwords
if old_pws:
for pw in old_pws:
if check_password(form.cleaned_data['new_password1'], pw):
messages.error(request,
f'You are not allowed a password which was already used in the last '
f'{allowed_reuse + 1} iterations')
return render(request, 'registration/password_change.html', {
'form': form
})