Skip to content
This repository has been archived by the owner on Jul 30, 2024. It is now read-only.

Remove password hashing for each token login #753

Open
wants to merge 2 commits into
base: develop
Choose a base branch
from
Open

Remove password hashing for each token login #753

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
1cf77ae
Remove password hashing for each token login
Feb 9, 2018
d438b5a
Remove pyflakes warning
Feb 9, 2018
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions flask_security/core.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,7 +30,7 @@
ResetPasswordForm, SendConfirmationForm
from .utils import config_value as cv
from .utils import _, get_config, hash_data, localize_callback, string_types, \
url_for_security, verify_hash, send_mail
url_for_security, send_mail
from .views import create_blueprint

# Convenient references
Expand Down Expand Up @@ -247,7 +247,7 @@ def _request_loader(request):
data = _security.remember_token_serializer.loads(
token, max_age=_security.token_max_age)
user = _security.datastore.find_user(id=data[0])
if user and verify_hash(data[1], user.password):
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think the reason to call verify_hash was to make sure that the token is invalidated once a user changes her password. Can you propose any solution that allows users to invalidate the remember token?

if user:
return user
except:
pass
Expand Down