A dollar sign broke the password
  • Python
  • FastAPI
  • Docker
  • Xavfsizlik

A dollar sign broke the password

25
Today I assembled the movie bot from start to finish: the bot, the admin app and the deployment. The bot works on subscriptions — a user pays, an admin confirms, then they get films through codes. I made a separate app for the admin, because opening the code every time to change plan prices or a card number is not a good arrangement. Now those are read from the database and edited in the admin app. At the end of the day came a bug that took a while. The admin password is stored as a hash in the configuration file. I generated the hash, wrote it to the file, tried to log in — it failed. I regenerated the hash — failed again. The reason: a bcrypt hash contains the `$` character, and it appears several times. But when a configuration file is read, `$` has a special meaning — the text after it is treated as a variable name. As a result, a mangled piece of the hash reached the program. The fix: I changed the separator inside the hash from `$` to `:`. Now there is no special character in the configuration file and the hash arrives intact. The unpleasant part of this bug was that the error message said "wrong password" — pointing me in completely the wrong direction. The password was right; the way it was stored was wrong. At the end I packed everything into Docker and shipped it to the server.