django user password, setup, validate and utilization

 offcial documentation :

https://docs.djangoproject.com/en/3.0/topics/auth/passwords/#included-hashers

How Django stores passwords¶

Django provides a flexible password storage system and uses PBKDF2 by default.

The password attribute of a User object is a string in this format:

<algorithm>$<iterations>$<salt>$<hash>

to store hashed password value in db

1) settings.py, include default django hash algortihm or custom one refer offical documentation :

// default

PASSWORD_HASHERS = [

    'django.contrib.auth.hashers.PBKDF2PasswordHasher',

    'django.contrib.auth.hashers.PBKDF2SHA1PasswordHasher',

    'django.contrib.auth.hashers.Argon2PasswordHasher',

    'django.contrib.auth.hashers.BCryptSHA256PasswordHasher',

]

he first entry in this list (that is, settings.PASSWORD_HASHERS[0]) will be used to store passwords, and all the other entries are valid hashers that can be used to check existing passwords.

2) make sure in core/models.py u have user class that extends AbstractBaseUser

https://stackoverflow.com/questions/62145059/how-to-use-check-password-function-in-django

then you can use default 

from django.contrib.auth.models 

import User

user = User.objects.create_user(username=username, email=email, password=password,

 #.. other required fields)

3) or you can manually do it using :

user = Person(name=name, id=id)
user.set_password(validated_data['password'])
user.save()

these will create a hash pwd entry in db

4) or you caneven write create_user function by defining UserManager in core/models.py

django comes with a default manager for every model, to perform default query set function, 

you can inheirt default manager to create a customized manager to use different default query set 

or customized one:

// https://docs.djangoproject.com/en/5.0/topics/db/managers/

// https://docs.djangoproject.com/en/5.0/ref/models/querysets/

// https://stackoverflow.com/questions/5173343/override-django-get-or-create

core/models.py

from re import I
from unittest.util import _MAX_LENGTH
from django.db import models
from django.contrib.auth.models import AbstractBaseUser, BaseUserManager, PermissionsMixin
from django.conf import settings
import rest_framework.authtoken.models

class UserManager(BaseUserManager):
    def create_user(self, name, password=None, **extra_fields):
        user = self.model(name=name, **extra_fields)
        user.set_password(password)
        user.save(using=self._db)
        return user

class User(AbstractBaseUser, PermissionsMixin):
    name  = models.CharField(max_length=255, blank=True, default='', unique=True)
    password = models.CharField(max_length=128 , blank=True, null=True)
    # use customized manager
    objects = UserManager()
    # Change default AbstractBaseUser (class models.User) USERNAME_FIELD
    USERNAME_FIELD = 'name'
    class Meta:
        unique_together = (('name', 'password'),)

// utlize

from django.contrib.auth import get_user_model

    userModel = get_user_model()
    userModel.objects.create_user(

7) check pwd:

https://stackoverflow.com/questions/62145059/how-to-use-check-password-function-in-django

https://docs.djangoproject.com/en/3.0/topics/auth/passwords/#included-hashers

user.check_password(password)