Merge pull request #138 from null-open-security-community/main

update password hasher

.github/workflows/staging.yml

@@ -43,6 +43,6 @@ jobs:
             docker load -i /tmp/null_job_backend_latest.tar/null_job_backend_latest.tar
             docker stop null_jobs_backend || true
             docker rm null_jobs_backend || true
-            docker run -d --network null_jobs --env-file /home/dev@null/projects/nulljobs/backend/.env null_jobs_backend:latest python manage.py migrate
+            docker run -d --network null_jobs -v /home/dev@null/projects/nulljobs/backend/media:/workspace/media --env-file /home/dev@null/projects/nulljobs/backend/.env null_jobs_backend:latest python manage.py migrate
             docker run -d --name null_jobs_backend --network null_jobs --restart always --env-file /home/dev@null/projects/nulljobs/backend/.env null_jobs_backend:latest python manage.py runserver 0.0.0.0:8000
             rm -r /tmp/null_job_backend_latest.tar

null_jobs_backend/settings.py

@@ -131,6 +131,10 @@
 # User Model
 AUTH_USER_MODEL = "accounts.User"
 
+PASSWORD_HASHERS = [
+    'django.contrib.auth.hashers.BCryptSHA256PasswordHasher',
+]
+
 # google auth settings
 ACCOUNT_AUTHENTICATION_METHOD = "email"
 ACCOUNT_EMAIL_REQUIRED = True
@@ -186,12 +190,8 @@
 DISABLE_TOKEN_EXPIRATION = True if DEBUG else False
 ENABLE_AUTHENTICATION = True
 SIMPLE_JWT = {
-    "ACCESS_TOKEN_LIFETIME": timedelta(days=365)
-    if DISABLE_TOKEN_EXPIRATION
-    else timedelta(minutes=3),
-    "REFRESH_TOKEN_LIFETIME": timedelta(days=365)
-    if DISABLE_TOKEN_EXPIRATION
-    else timedelta(minutes=7),
+    "ACCESS_TOKEN_LIFETIME": timedelta(days=365) if DISABLE_TOKEN_EXPIRATION else timedelta(minutes=3),
+    "REFRESH_TOKEN_LIFETIME": timedelta(days=365) if DISABLE_TOKEN_EXPIRATION else timedelta(minutes=7),
     "ROTATE_REFRESH_TOKENS": False,
     "BLACKLIST_AFTER_ROTATION": False,
     "CHECK_REVOKE_TOKEN": True,

requirements.txt

@@ -2,6 +2,7 @@ asgiref==3.7.2
 astroid==2.15.6
 attrs==23.2.0
 backports.zoneinfo==0.2.1
+bcrypt==4.2.0
 certifi==2023.7.22
 cfgv==3.3.1
 charset-normalizer==3.2.0