Mention that when using Argon2PasswordHasher, this means Argon2id gets used

[David Schultz]

In the documentation page on "Password management in Django", the section on Argon2 should mention that with the settings described there, the specific algorithm that gets actually used is the variant Argon2id. Namely, one should not have to look in another place to ascertain which precise algorithm gets used when one makes the changes described there (as it's quite important to know for sure that one will indeed be using Argon2id instead of any other variant out there).

Link to the documentation section concerned: ​https://docs.djangoproject.com/en/4.1/topics/auth/passwords/#using-argon2-with-django
Currently, the fact that Argon2id is indeed the default in Django (when using Argon2), is to my knowledge only mentioned here: ​https://docs.djangoproject.com/en/4.1/releases/3.2/

[Mariusz Felisiak]

Agreed. Would you like to prepare a patch? It should be enough to mention Argon2id in topics, e.g.

docs/topics/auth/passwords.txt

@@ -83 +83 @@
 Argon2_ is the winner of the 2015 `Password Hashing Competition`_, a community
 organized open competition to select a next generation hashing algorithm. It's
 designed not to be easier to compute on custom hardware than it is to compute
-on an ordinary CPU.
+on an ordinary CPU. The default variant for the Argon2 password hasher is
+Argon2id.
 
 Argon2_ is not the default for Django because it requires a third-party
 library. The Password Hashing Competition panel, however, recommends immediate

[David Schultz]

Currently I can't familiarize myself with the steps necessary to prepare such a patch, so I would kindly ask you or someone else to do this. The text which I would propose is this, building upon your suggestion:

docs/topics/auth/passwords.txt

@@ -83 +83 @@
 Argon2_ is the winner of the 2015 `Password Hashing Competition`_, a community
 organized open competition to select a next generation hashing algorithm. It's
 designed not to be easier to compute on custom hardware than it is to compute
-on an ordinary CPU.
+on an ordinary CPU. The default variant for the Argon2 password hasher is
+Argon2id.
 
 Argon2_ is not the default for Django because it requires a third-party
 library. The Password Hashing Competition panel, however, recommends immediate
 use of Argon2 rather than the other algorithms supported by Django.
 
-To use Argon2 as your default storage algorithm, do the following:
+To use Argon2id as your default storage algorithm, do the following:

[Mariusz Felisiak]

​PR

[GitHub <noreply@…>]

In c11336cd:

Fixed #34017 -- Doc'd that Argon2id variant is used by Argon2PasswordHasher.

[Mariusz Felisiak <felisiak.mariusz@…>]

In 0859093f:

[4.1.x] Fixed #34017 -- Doc'd that Argon2id variant is used by Argon2PasswordHasher.

Backport of c11336cd990e155371a5185cf3bd6942cad8d9da from main