verify(hash, password) : Please return False about argon2-cffi HOT 3 CLOSED

I have added a FAQ entry in c79d63f to explain the reasoning.

I’m sorry you find it inconvenient, but I can’t change the API anymore (imagine all the people who rely on verify raising an exception!) and I find in security context that safety goes over typing convenience.

If you really can’t stand it, nobody's stopping you from wrapping PasswordHasher or subclassing it and adding a more pleasing façade to it.

from argon2-cffi.

This still contradicts literally every single password check function in other libraries. Why not provide another method or just a helper function that properly returns a boolean? Also, why return True at all if the return value of the function is meaningless?

from argon2-cffi.

I agree with @ThiefMaster here. I was evaluating this library, and the raising of exceptions seems very odd, and a cumbersome api to use. The bcrypt api, for example, is much nicer to use. The seeming use of classes for classes sake, also is unfortunate.

If you really can’t stand it, nobody's stopping you from wrapping PasswordHasher or subclassing it and adding a more pleasing façade to it.

Sure. It is just busy work and hassle.

Anyway, bummer. As you consider this a misfeature, I will look around for other libraries.

from argon2-cffi.