Stored salted token and token comparison
<p>I'm generating an url composed of a single use token, and sending it to a user by e-mail. The user should click this link and be redirected to a page which will validate the token and do some actions. </p>

<p>On the database side, I'm storing this token (hashed and salted, for security reasons). The problem is I'm having some difficulties to validate the the token because, the way I'm storing it, I cannot generate the same salt for the same token. And, therefore, I cannot compare this salt with the ones I have stored.</p>

<pre><code># Retrieving or creating object usertokens
usr, created = UserToken.objects.get_or_create(email=email)
# Adding a new token
token = uuid.uuid4().hex
usr.token = make_password(token) # Stores in the local database the salted and hashed token
usr.save()
</code></pre>

<p>This make_password method I'm using is defined in <code>django.contrib.auth.hashers</code>.</p>

<p>By using this method, I cannot generate two times the same salt from the same token.</p>

<pre><code>&gt;&gt;&gt; token = 'test'
&gt;&gt;&gt; enc_token1 = make_password(token)
&gt;&gt;&gt; enc_token2 = make_password(token)
&gt;&gt;&gt; enc_token1 == enc_token2
False
</code></pre>

<p>This, however, does not help me to retrieve from my database the entry corresponding to the token and I cannot validate it.</p>

<p>Using a simple string equality check of two hashed and salted tokens will not work. The <a href="https://docs.djangoproject.com/en/1.10/topics/auth/passwords/#django.contrib.auth.hashers.check_password" rel="nofollow">Django docs for password management</a> offer a very simple method in the <code>django.contrib.auth.hashers</code> namespace that handles all of this for you:</p>

<pre><code>&gt;&gt;&gt; token = 'test'
&gt;&gt;&gt; enc_token1 = make_password(token)
&gt;&gt;&gt; check_password('test', enc_token1)
True
</code></pre>

<p>The <code>check_password</code> method does a few things behind the hood, like check if the hashing algorithm has changed. It returns the result of the <code>verify</code> method of an algorithm that implements the <code>BasePasswordHasher</code> baseclass. Here's an example of an implementation from the <a href="https://docs.djangoproject.com/en/1.10/_modules/django/contrib/auth/hashers/#check_password" rel="nofollow">source of the <code>PBKDF2PasswordHasher</code></a>:</p>

<pre><code>def verify(self, password, encoded):
    algorithm, iterations, salt, hash = encoded.split('$', 3)
    assert algorithm == self.algorithm
    encoded_2 = self.encode(password, salt, int(iterations))
    return constant_time_compare(encoded, encoded_2)
</code></pre>

<p>Note how the salt is found by splitting the encoded_string on '$', since the <a href="https://docs.djangoproject.com/en/1.10/topics/auth/passwords/#how-django-stores-passwords" rel="nofollow">Django docs note</a> that</p>

<blockquote>
  <p>The password attribute of a User object is a string in this format:</p>

<pre><code>&lt;algorithm&gt;$&lt;iterations&gt;$&lt;salt&gt;$&lt;hash&gt;
</code></pre>
</blockquote>

python django