OpenListTeam / OpenListTeam/OpenList-Docs
[Bug] API Doc中,User login with pre-hashed password 部分有关于密码Hash算法的说法有误
Open
@ILoveScratch2 is already working on this.
Since Dec 29, 2025.
API
- Dominant language
- Vue
- Stars
- 63
- Forks
- 130
- Avg merge
- 1d 2h
- Merged PRs (30d)
- 6
Description
原文档中的表述为:
SHA256 hash of password
Example:hashed_password_string
经过实际测试,依照文档描述为密码进行SHA256哈希,即sha256(password.encode()).hexdigest()生成的哈希并不能成功登录。
摸排源代码得知,相关代码位于https://github.com/OpenListTeam/OpenList/blob/main/internal/model/user.go#L157,实际上是一个加盐哈希算法,而不是文档中描述的“密码的SHA256哈希”。Salt为固定值https://github.com/alist-org/alist。
因此,以下写法才是符合事实的
STATIC_HASH_SALT = "https://github.com/alist-org/alist"
combined = f"{password}-{STATIC_HASH_SALT}"
hashed_password = sha256(combined.encode()).hexdigest()
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.