Passwords and Encoding

Installation

1.) Install the cryptography library:

pip install cryptography

2.) Generate a secret key and save it in your .env as FERNET_KEY='...', then if you are using Heroku add the same key to Settings -> Config Vars

python -c 'from cryptography.fernet import Fernet; print(Fernet.generate_key().decode())'

---

models.py

Imports:

from cryptography.fernet import Fernet
from decouple import config

Add the encrypted password and note fields to your model (in this case the custom user profile model)

...
    encrypted_password = models.BinaryField(null=True)
    encrypted_note = models.BinaryField(null=True)
...

---

ENCRYPTED PASSWORD

forms.py

Create three separate forms (create password, update password and check password)

class EncryptedPasswordForm(forms.Form):
    password = forms.CharField(widget=forms.PasswordInput(attrs={'class': 'form-control'}), required=True)

class PasswordUpdateForm(forms.Form):
    old_password = forms.CharField(widget=forms.PasswordInput(attrs={'class': 'form-control'}), required=True)
    new_password = forms.CharField(widget=forms.PasswordInput(attrs={'class': 'form-control'}), required=True)
    confirm_new_password = forms.CharField(widget=forms.PasswordInput(attrs={'class': 'form-control'}), required=True)

class PasswordCheckForm(forms.Form):
    password = forms.CharField(widget=forms.PasswordInput(attrs={'class': 'form-control'}), required=True)

views.py

Imports:

from cryptography.fernet import Fernet
from decouple import config

from tools_app.forms import EncryptedPasswordForm, PasswordCheckForm, PasswordUpdateForm

Create password view

@login_required
def encrypted_password(request):
    profile = DBProfile.objects.get(user=request.user)
    if profile.encrypted_password:
        messages.warning(request, "Password already exists")
        return redirect('profile-show')
    else:
        if request.method == 'POST':
            form = EncryptedPasswordForm(request.POST)
            if form.is_valid():
                password = form.cleaned_data['password']
                fernet = Fernet(bytes(config('FERNET_KEY'), 'utf-8'))
                encrypted_password = fernet.encrypt(password.encode())
                profile.encrypted_password = encrypted_password
                profile.save()
                return redirect('profile-show')
        else:
            form = EncryptedPasswordForm()
        return render(request, 'tools_app/encrypted_password.html', {'form': form})

Update password view

@login_required
def encrypted_password_update(request):
    profile = DBProfile.objects.get(user=request.user)
    if request.method == 'POST':
        form = PasswordUpdateForm(request.POST)
        if form.is_valid():
            old_password = form.cleaned_data['old_password']
            new_password = form.cleaned_data['new_password']
            confirm_new_password = form.cleaned_data['confirm_new_password']
            if new_password == confirm_new_password:
                fernet = Fernet(bytes(config('FERNET_KEY'), 'utf-8'))
                key = Fernet(config('FERNET_KEY').encode('utf-8'))
                encrypted_old_password = bytes(profile.encrypted_password)
                decrypted_old_password = key.decrypt(encrypted_old_password).decode()
                if old_password == decrypted_old_password:
                    encrypted_new_password = fernet.encrypt(new_password.encode())
                    profile.encrypted_password = encrypted_new_password
                    profile.save()
                    messages.success(request, 'Password updated successfully')
                    return redirect('profile-show')
                else:
                    messages.success(request, "Invalid old password")
            else:
                messages.success(request, "Passwords don't match")
    else:
        form = PasswordUpdateForm()
    return render(request, 'tools_app/encrypted_password.html', {'form': form})

Templates: encrypted_password.html

{% extends 'base.html' %}
{% block title %} Encrypted Password {% endblock %}
{% if user.is_authenticated %}
    {% block content %}

    {% if user.dbprofile %}

        <h1>Password</h1>
        <form method="post">
        {% csrf_token %}
        {{ form.as_p }}
        <button type="submit" class="btn btn-primary">Save</button>
        </form>
    {% else %}
        <a class="btn btn-outline-secondary" href="{% url 'profile-add' %}">Create your profile</a>
        
    {% endif %}

    {% endblock %}
{% endif %}

---

ENCRYPTED NOTE

forms.py

class EncryptedNoteForm(forms.Form):
    note = forms.CharField(widget=TinyMCE(mce_attrs={'height': '800'},),)

    def __init__(self, *args, **kwargs):
        self.user = kwargs.pop('user')
        super(EncryptedNoteForm, self).__init__(*args, **kwargs)

views.py

Imports:

from tools_app.forms import EncryptedNoteForm

@login_required
def encrypted_note(request):
    user = request.user
    profile = DBProfile.objects.get(user=user)
    permission = request.POST.get('permission')
    if request.method == "POST" and 'password_check' in request.POST:
        password_form = PasswordCheckForm(request.POST)
        if password_form.is_valid():
            password = password_form.cleaned_data['password']
            encrypted_password = bytes(profile.encrypted_password)
            key = Fernet(config('FERNET_KEY').encode('utf-8'))
            decrypted_password = key.decrypt(encrypted_password).decode()
            if password == decrypted_password:
                permission = 'allowed'
    else:
        password_form = PasswordCheckForm()

    if request.method == 'POST' and 'update_note' in request.POST and permission == 'allowed':
        note_form = EncryptedNoteForm(request.POST, user=user)
        if note_form.is_valid():
            note = note_form.cleaned_data['note']
            key = Fernet(config('FERNET_KEY').encode('utf-8'))
            encrypted_note = key.encrypt(note.encode('utf-8'))
            profile.encrypted_note = encrypted_note
            profile.save()
            messages.success(request, 'Note updated')
            return redirect('encrypted-note')
    else:
        if profile.encrypted_note:
            encrypted_note = bytes(profile.encrypted_note)
            if encrypted_note:
                key = Fernet(config('FERNET_KEY').encode('utf-8'))
                decrypted_note = key.decrypt(bytes(encrypted_note)).decode()
            else:
                decrypted_note = ''
        else:
            decrypted_note = ''
        note_form = EncryptedNoteForm(user=user, initial={'note': decrypted_note})
    return render(request, 'tools_app/encrypted_note.html', {
        'note_form': note_form,
        'password_form': password_form,
        'permission': permission,
    })

Templates: encrypted_note.html

{% extends 'base.html' %}
{% block title %} Encrypted Note {% endblock %}
{% if user.is_authenticated %}
    {% block content %}

    {% if user.dbprofile %}
        {% if permission != 'allowed' %}
        <form method="post">
            {% csrf_token %}
            {{ password_form.as_p }}      
            <button type="submit" class="btn btn-primary" name="password_check">Submit</button>
        </form>
        {% endif %}
    
        {% if permission == 'allowed' %}
        <form method="post">
            {% csrf_token %}
            {{ note_form.as_p }}
            {{ note_form.media }}
            <input type="hidden" name="permission" value="{{ permission }}">
            <button type="submit" class="btn btn-primary" name="update_note">Save</button>
        </form>
        {% endif %}

    {% else %}
        <a class="btn btn-outline-secondary" href="{% url 'profile-add' %}">Create your profile</a>
    {% endif %}

    {% endblock %}
{% endif %}

---

urls.py

...
    path('encrypted_password/', encrypted_password, name='encrypted-password'),
    path('encrypted_note/', encrypted_note, name='encrypted-note'),
    path('encrypted_password_update/', encrypted_password_update, name='encrypted-password-update'),
...

Links

{% if user.dbprofile %}
<div class="container text-center mb-4">
    <h6>ENCRYPTED NOTE</h6>
        {% if user.dbprofile.encrypted_password %}
            <a href="{% url 'encrypted-note' %}" class="btn btn-outline-dark border-0 btn-sm" style="min-width: 50px;">
                <svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" fill="currentColor" class="bi bi-journal-plus" viewBox="0 0 16 16"><path fill-rule="evenodd" d="M8 5.5a.5.5 0 0 1 .5.5v1.5H10a.5.5 0 0 1 0 1H8.5V10a.5.5 0 0 1-1 0V8.5H6a.5.5 0 0 1 0-1h1.5V6a.5.5 0 0 1 .5-.5z"/><path d="M3 0h10a2 2 0 0 1 2 2v12a2 2 0 0 1-2 2H3a2 2 0 0 1-2-2v-1h1v1a1 1 0 0 0 1 1h10a1 1 0 0 0 1-1V2a1 1 0 0 0-1-1H3a1 1 0 0 0-1 1v1H1V2a2 2 0 0 1 2-2z"/><path d="M1 5v-.5a.5.5 0 0 1 1 0V5h.5a.5.5 0 0 1 0 1h-2a.5.5 0 0 1 0-1H1zm0 3v-.5a.5.5 0 0 1 1 0V8h.5a.5.5 0 0 1 0 1h-2a.5.5 0 0 1 0-1H1zm0 3v-.5a.5.5 0 0 1 1 0v.5h.5a.5.5 0 0 1 0 1h-2a.5.5 0 0 1 0-1H1z"/></svg>
                <br><small style="font-size: x-small;">Edit note</small>
            </a>
            <a href="{% url 'encrypted-password-update' %}" class="btn btn-outline-dark border-0 btn-sm" style="min-width: 50px;">
                <svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" fill="currentColor" class="bi bi-key-fill" viewBox="0 0 16 16"><path d="M3.5 11.5a3.5 3.5 0 1 1 3.163-5H14L15.5 8 14 9.5l-1-1-1 1-1-1-1 1-1-1-1 1H6.663a3.5 3.5 0 0 1-3.163 2zM2.5 9a1 1 0 1 0 0-2 1 1 0 0 0 0 2z"/></svg>
                <br><small style="font-size: x-small;">Update Password</small>
            </a>
        {% else %}
            <a href="{% url 'encrypted-password' %}" class="btn btn-outline-dark border-0 btn-sm" style="min-width: 50px;">
                <svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" fill="currentColor" class="bi bi-key-fill" viewBox="0 0 16 16"><path d="M3.5 11.5a3.5 3.5 0 1 1 3.163-5H14L15.5 8 14 9.5l-1-1-1 1-1-1-1 1-1-1-1 1H6.663a3.5 3.5 0 0 1-3.163 2zM2.5 9a1 1 0 1 0 0-2 1 1 0 0 0 0 2z"/></svg>
                <br><small style="font-size: x-small;">Add Password</small>
            </a>
        {% endif %}

        <a type="button" data-bs-toggle="modal" data-bs-target="#ENCRYPTED_NOTE_Modal" style="text-decoration: none;" class="btn btn-outline-dark border-0 btn-sm {% if nv == 'events'%}btn-primary text-white{% endif %}" style="min-width: 50px;">
            <svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" fill="currentColor" class="bi bi-info-square" viewBox="0 0 16 16"><path d="M14 1a1 1 0 0 1 1 1v12a1 1 0 0 1-1 1H2a1 1 0 0 1-1-1V2a1 1 0 0 1 1-1h12zM2 0a2 2 0 0 0-2 2v12a2 2 0 0 0 2 2h12a2 2 0 0 0 2-2V2a2 2 0 0 0-2-2H2z"/><path d="m8.93 6.588-2.29.287-.082.38.45.083c.294.07.352.176.288.469l-.738 3.468c-.194.897.105 1.319.808 1.319.545 0 1.178-.252 1.465-.598l.088-.416c-.2.176-.492.246-.686.246-.275 0-.375-.193-.304-.533L8.93 6.588zM9 4.5a1 1 0 1 1-2 0 1 1 0 0 1 2 0z"/></svg>
            <br><small style="font-size: x-small;">Description</small>
        </a>

        <div class="modal fade" id="ENCRYPTED_NOTE_Modal" tabindex="-1" aria-labelledby="ENCRYPTED_NOTE_ModalLabel" aria-hidden="true">
            <div class="modal-dialog">
            <div class="modal-content">
                <div class="modal-header">
                <h4 class="modal-title fs-5" id="ENCRYPTED_NOTE_ModalLabel">ENCRYPTED NOTE DESCRIPTION</h4>
                <button type="button" class="btn-close" data-bs-dismiss="modal" aria-label="Close"></button>
                </div>
                <div class="modal-body text-start">
                    <p>The Encrypted Note feature has been added to give you an option to create a note that is highly secure to access and store. This single note is protected with the Advanced Encryption Standard and 128-bit key, using the Fernet library in Python. The password and the note itself are both encrypted, which means that they are not stored in the database as plain text. The encryption key is also not stored in the codebase, which provides an extra layer of security. In the unlikely event that the codebase or the database itself gets into the hands of hackers, your data will still be secure thanks to the robust encryption and key management provided by Fernet.</p>
                    <p>Fernet uses a symmetric encryption scheme, which means that the same key is used for both encryption and decryption. The key is derived from a user-provided password using a key derivation function, which makes it computationally infeasible for an attacker to recover the password from the key. Additionally, Fernet uses a message authentication code (MAC) to verify the integrity of the ciphertext and prevent tampering. This ensures that your data is not only encrypted, but also protected against malicious modifications.</p>
                    <p>It's important to note that there is no way to restore a forgotten password. If you forget your password, you will have to contact the administrator to have it reset. Therefore, it's recommended that you choose a strong, memorable password and keep it in a safe place.</p>

                </div>
            </div>
            </div>
        </div>
</div>
{% endif %}