diff options
Diffstat (limited to 'docs/releases/1.6.txt')
| -rw-r--r-- | docs/releases/1.6.txt | 21 |
1 files changed, 13 insertions, 8 deletions
diff --git a/docs/releases/1.6.txt b/docs/releases/1.6.txt index 8bbc483542..2903038b53 100644 --- a/docs/releases/1.6.txt +++ b/docs/releases/1.6.txt @@ -780,6 +780,19 @@ as JSON requires string keys, you will likely run into problems if you are using non-string keys in ``request.session``. See the :ref:`session_serialization` documentation for more details. +4096-byte limit on passwords +~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +Historically, Django has imposed no length limit on plaintext +passwords. This enables a denial-of-service attack through submission +of bogus but extremely large passwords, tying up server resources +performing the (expensive, and increasingly expensive with the length +of the password) calculation of the corresponding hash. + +Django now imposes a 4096-byte limit on password length, and will fail +authentication with any submitted password of greater length. + + Miscellaneous ~~~~~~~~~~~~~ @@ -869,14 +882,6 @@ Miscellaneous to prevent django from deleting the temporary .pot file it generates before creating the .po file. -* Passwords longer than 4096 bytes in length will no longer work and will - instead raise a ``ValueError`` when using the hasher directory or the - built in forms shipped with ``django.contrib.auth`` will fail validation. - - The rationale behind this is a possibility of a Denial of Service attack when - using a slow password hasher, such as the default PBKDF2, and sending very - large passwords. - Features deprecated in 1.6 ========================== |