你的密码存储方式是否在向黑客招手？

# 理想密码存储结构示意图
{
    "username": "user@example.com",
    "password_hash": "$2b$12$e5EsmjmzkE6cCa6U7X/7ReXBQFjDcPBrG7jCk6S8NIVZu7SQTSlwW",
    "salt": "bf83b8d80e394f069e7a"
}

from fastapi import Depends, FastAPI, HTTPException
from pydantic import BaseModel, SecretStr
import bcrypt

app = FastAPI()


class UserCreate(BaseModel):
    username: str
    password: SecretStr  # 自动屏蔽敏感信息输出


class HashedPassword:
    def __init__(self, salt: bytes, hashed: bytes):
        self.salt = salt
        self.hashed = hashed


def hash_password(plain_password: SecretStr) -> HashedPassword:
    salt = bcrypt.gensalt(rounds=12)  # 推荐迭代次数
    hashed = bcrypt.hashpw(plain_password.get_secret_value().encode(), salt)
    return HashedPassword(salt, hashed)


def verify_password(plain_password: SecretStr, hashed_password: HashedPassword) -> bool:
    return bcrypt.checkpw(
        plain_password.get_secret_value().encode(),
        hashed_password.hashed
    )


@app.post("/register")
async def register(user: UserCreate, hasher=Depends(hash_password)):
    # 实际应存储到数据库
    return {
        "username": user.username,
        "password_hash": hasher.hashed.decode(),
        "salt": hasher.salt.decode()
    }

from typing import Annotated
from fastapi import Depends


def validate_password_complexity(password: SecretStr):
    value = password.get_secret_value()
    if len(value) < 10:
        raise ValueError("密码至少10个字符")
    if not any(c.isupper() for c in value):
        raise ValueError("必须包含大写字母")
    # 更多复杂度规则...


@app.post("/enhanced-register")
async def enhanced_register(
        password: Annotated[SecretStr, Depends(validate_password_complexity)]
):
    return {"message": "密码符合强度要求"}

from fastapi import Request
from slowapi import Limiter
from slowapi.util import get_remote_address

limiter = Limiter(key_func=get_remote_address)
app.state.limiter = limiter


@app.post("/login")
@limiter.limit("5/minute")  # 同一IP每分钟5次尝试
async def login(request: Request, user: UserCreate):
# 验证逻辑...

HTTP
401
Unauthorized
{
    "detail": "Invalid credentials"
}

AttributeError: module
'bcrypt'
has
no
attribute
'gensalt'

import pytest
from .main import hash_password, verify_password


def test_password_hashing():
    original = SecretStr("SecurePassw0rd!")
    hashed = hash_password(original)

    assert verify_password(original, hashed), "正确密码应验证通过"
    assert not verify_password(SecretStr("wrongpass"), hashed), "错误密码应失败"

    # 验证盐值唯一性
    second_hash = hash_password(original)
    assert hashed.hashed != second_hash.hashed, "相同密码应生成不同哈希"