Skip to content
This repository has been archived by the owner on Jun 10, 2024. It is now read-only.

Constant time comparison in authentication method #999

Open
wants to merge 2 commits into
base: master
Choose a base branch
from
Open

Constant time comparison in authentication method #999

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
4042e74
feat: constant time comparison in authentication
Strohy Apr 30, 2024
e0c62e9
chore: update import
Strohy Apr 30, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
5 changes: 3 additions & 2 deletions pyspider/webui/login.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,6 +6,7 @@
# Created on 2014-12-10 20:36:27

import base64
import hmac
from flask import Response
try:
import flask_login as login
Expand Down Expand Up @@ -41,8 +42,8 @@ def __init__(self, id, password):
def is_authenticated(self):
if not app.config.get('webui_username'):
return True
if self.id == app.config.get('webui_username') \
and self.password == app.config.get('webui_password'):
if hmac.compare_digest(self.id.encode('utf-8'), app.config.get('webui_username').encode('utf-8')) \
and hmac.compare_digest(self.password.encode('utf-8'), app.config.get('webui_password').encode('utf-8')):
return True
return False

Expand Down