Invalid Salt when using bcrypt.checkpw - django

Question

I am working on a user authentification app using Django. The app allows the user to create an account then login. However, on the login side i am getting an error when checking for the user password using bcrypt.checkpw
I tried printing the value of the user password and the one saved on the data base. I am using SQLite for the database by the way
print(request.POST['login_password'].encode())
print(user.password)
here is the output:
b'87654321'
b'$2b$12$bQ6tEDKh.tOJnnPAj84Xe.BZnGi9kI.Sc6Q4gFPeTLw9x53VSVQOW'
I also tried:
print(request.POST['login_password'].encode())
print(user.password.encode())
b'87654321'
b"b'$2b$12$bQ6tEDKh.tOJnnPAj84Xe.BZnGi9kI.Sc6Q4gFPeTLw9x53VSVQOW'"
To creat user:
user = MasjeedUser.objects.create(first_name=request.POST['first_name'],last_name=request.POST['last_name'],password=bcrypt.hashpw(request.POST['password'].encode(), bcrypt.gensalt()),email=request.POST['email'])
to query password:
when i use
if bcrypt.checkpw(request.POST['login_password'].encode(),user.password)
i get as an error: Unicode-objects must be encoded before checking
when i tried
if bcrypt.checkpw(request.POST['login_password'].encode(),user.password.encode())
i get as an error: invalid salt

Answer 1

The reason you have an invalid salt is that you have an extra b'...' around the hashed password. That's because the result of hashpw is a bytestring, and Django will automatically call str on anything passed into a charfield that is not a string. You would need to decode it first.
But in any case you must not do any of this. Although bcrypt is a perfectly good hashing library, there is no reason for you to duplicate the functionality that Django gives you; by doing so, you will almost certainly introduce new security vulnerabilities. Don't do this. Inherit your MasjeedUser from the AbstractUser or AbstractBaseUser models in django.contrib.admin, and use their set_password and check_password methods.