Meteor Auth in Python

asad · May 31, 2017, 5:30pm

Hey all!

I’m working on an app that connects to my Meteor app using Python. It connects to MongoDB and I would like to do password Auth using this app. How would I go about checking Meteor passwords in Python?

herteby · May 31, 2017, 6:43pm

If there’s no package available for Python and you’re prepared to do it yourself, here is the code you need to translate to Python

github.com

meteor/meteor/blob/release-1.5/packages/accounts-password/password_server.js

/// BCRYPT

var bcrypt = NpmModuleBcrypt;
var bcryptHash = Meteor.wrapAsync(bcrypt.hash);
var bcryptCompare = Meteor.wrapAsync(bcrypt.compare);

// User records have a 'services.password.bcrypt' field on them to hold
// their hashed passwords (unless they have a 'services.password.srp'
// field, in which case they will be upgraded to bcrypt the next time
// they log in).
//
// When the client sends a password to the server, it can either be a
// string (the plaintext password) or an object with keys 'digest' and
// 'algorithm' (must be "sha-256" for now). The Meteor client always sends
// password objects { digest: *, algorithm: "sha-256" }, but DDP clients
// that don't have access to SHA can just send plaintext passwords as
// strings.
//
// When the server receives a plaintext password as a string, it always
// hashes it with SHA256 before passing it into bcrypt. When the server

This file has been truncated. show original

Actually a lot of it is not related to passwords, so it might not be too much work. You just need to find an equivalent of bcrypt for Python.

asad · May 31, 2017, 8:03pm

I tried this:

hashed = hashlib.sha256(password_string).hexdigest()
encrypted = bcrypt.hashpw(hashed, bcrypt.gensalt(10))

But the encrypted string produced is different from the one Meteor generates. Any idea where I might be going wrong?

asad · June 1, 2017, 9:53am

Anyone got any ideas how to get this to work?

arcadesiva · March 13, 2020, 2:34pm

This might be useful if you are using Django. In Meteor, a password will not contain the algorithm used “bcrypt_sha256$”. Just prepend the algorithm with the hash created in the Meteor app to validate in the Python Django framework.

from django.contrib.auth.hashers import BCryptSHA256PasswordHasher

hasher = BCryptSHA256PasswordHasher()
#encoded = hasher.encode(password="12345", salt=hasher.salt())

meteor_generated_hash = "$2a$10$aahDgK1G0kxmfZdjgU9G5.yG9W9guYSsxp/opdjCTFVhRUnxXs4BG"

print(hasher.verify("12345", "bcrypt_sha256$" + meteor_generated_hash))