GlcoinCore/blitz_api
1
0
Fork 0
mirror of https://github.com/fusion44/blitz_api.git synced 2026-08-19 12:37:30 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

feat: use secrets.compare_digest in login

Browse source 
More info:
https://fastapi.tiangolo.com/advanced/security/http-basic-auth/#timing-attacks
This commit is contained in:
Stefan Stammberger 2021-10-03 10:58:46 +02:00
parent f7e1cf206d
commit 8d1357cf09
No known key found for this signature in database
GPG key ID: 645FA807E935D9D5
1 changed files with 4 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

5
app/routers/system.py
View file

@ -1,3 +1,5 @@
import secrets
from app.auth.auth_bearer import JWTBearer
from app.auth.auth_handler import signJWT
from app.models.system import LoginInput, RawDebugLogData, SystemInfo
@ -32,7 +34,8 @@ router = APIRouter(prefix=f"/{_PREFIX}", tags=["System"])
status_code=status.HTTP_200_OK,
)
def login(i: LoginInput):
if i.password == config("login_password", cast=str):
match = secrets.compare_digest(i.password, config("login_password", cast=str))
if match:
return signJWT()
raise HTTPException(status.HTTP_401_UNAUTHORIZED, detail="Password is wrong")