diff options
| author | Steve Piercy <web@stevepiercy.com> | 2016-02-27 00:59:17 -0800 |
|---|---|---|
| committer | Steve Piercy <web@stevepiercy.com> | 2016-02-27 00:59:17 -0800 |
| commit | 082d3b2cb9127f8acfd4d081e69c427a37bae91d (patch) | |
| tree | 72d1bcdc64a352ac0acc69a575cac4d4423074b5 /docs/quick_tutorial/retail_forms | |
| parent | a6db36c984bd69f8a6aba80ad6db435cd4b1b93c (diff) | |
| download | pyramid-082d3b2cb9127f8acfd4d081e69c427a37bae91d.tar.gz pyramid-082d3b2cb9127f8acfd4d081e69c427a37bae91d.tar.bz2 pyramid-082d3b2cb9127f8acfd4d081e69c427a37bae91d.zip | |
wiki2 authentication bug fix and improvement against timing attack
- Bytes type does not have encode method. The expected_hash retrieved from the database is a bytes object.
- Use hmac.compare_digest instead of == to avoid timing attacks as a recommended security best practice. See https://www.python.org/dev/peps/pep-0466/ https://bugs.python.org/issue21306 and https://codahale.com/a-lesson-in-timing-attacks/ for details.
Note, however, this was not backported to py2.6. For a tutorial, I am OK with stating this will not work on Python 2.6 with a clear warning note at the start of the tutorial and on the authentication step.
Diffstat (limited to 'docs/quick_tutorial/retail_forms')
0 files changed, 0 insertions, 0 deletions