Flask-security: Using create_user does not hash the password

[joeyespo]

Calling register_user will hash the password, as expected, but bypassing it to create a user with the same password will store it in plaintext. This isn't expected and requires your code to depend on the password hashing library explicitly.

Could Flask-Security move the following line from register_user to create_user?

kwargs['password'] = encrypt_password(kwargs['password'])

I can't think of a case where you'd want to intentionally store plaintext, but then again, I haven't been using Flask-Security for very long.

[mattupstate]

Conceptually there is a difference between the Datastore object and the registerable module. The Datastore object is a very simple layer on top of the ORM. It is not concerned with manipulating the data before it is inserted into the database. I prefer this separation of concerns. If you want to create a user with the datastore.create_user function, you can import flask_security.utils.encrypt_password to do what you need before creating the new record in the database.

[joeyespo]

Ok, I figured it had something to do with Datastore being light-weight. I noticed it does do some slight data manipulation to get the roles right in _prepare_create_user_args, so figured I'd ask. It was just surprising to me initially since you generally don't ever want to store a plaintext password.

Separating the concerns makes sense though.

Thanks for the comment, Matt!

[mattupstate]

No problem!