The library can't be updated automatically, because suddenly all your stored passwords wouldn't work.
If it's a big monolithic library like Spring, they just deprecate APIs and add new ones (which is in fact what they do); if you're in a microframework language like Node, you're on your own to rip out your md5 module and switch it to bcrypt.
> because suddenly all your stored passwords wouldn't work.
Passlib handles that with a concept of "deprecated algorithms"[0]: a cryptcontext has a list of algorithms it can accept as inputs to validate against, and a subset of these can be marked as deprecated[1]. The passwords hashed with deprecated algorithms will validate but they'll be flagged as needing an upgrade. The `verify_and_upgrade` method will return both the validity of the password and a new hash if it should be upgraded, so the normal pattern is:
valid, new_hash = pass_ctx.verify_and_update(password, old_hash)
if valid:
if new_hash:
# store new hash for user
# password was valid
else:
# password wasn't valid
[1] in recent versions you can even set the deprecated list to "auto", this will consider all algorithms but the default (the one used if you encrypt with the cryptcontext without requesting anything specific) to be deprecated. It's a thing of beauty.
Django's auth system handles updates safely and cleanly. Don't know about others, but the mechanism is simple:
* The value stored in the DB is actually of the form "algorithm$iterations$salt$hash".
* The current preferred algorithm and iterations are configurable in the settings.
* When logging a user in, the algorithm/iterations in the stored value are used to check the password.
* If the stored value's algorithm/iterations are out of sync with the preferred algorithm/iterations in the settings, then the last step of the login process is to re-hash the (verified correct) submitted password with the new preferred algorithm/iterations, and push that value back to the DB.
Which creates a rolling refresh of the stored values as users log in, which in turn lets you gracefully change the algorithm or number of iterations.
If it's a big monolithic library like Spring, they just deprecate APIs and add new ones (which is in fact what they do); if you're in a microframework language like Node, you're on your own to rip out your md5 module and switch it to bcrypt.