quart-security 1.2.1__tar.gz → 1.4.0__tar.gz

{quart_security-1.2.1 → quart_security-1.4.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: quart-security
-Version: 1.2.1
+Version: 1.4.0
 Summary: Native async auth for Quart
 Author: quart-security maintainers
 Requires-Python: >=3.11
@@ -11,12 +11,13 @@ Requires-Dist: sqlalchemy>=2.0
 Requires-Dist: libpass>=1.9
 Requires-Dist: pyotp>=2.9
 Requires-Dist: qrcode>=8.0
-Requires-Dist: webauthn>=2.0
+Requires-Dist: webauthn>=2.7
 Requires-Dist: wtforms>=3.1
 Requires-Dist: aiosmtplib>=3.0
 Requires-Dist: blinker>=1.7
-Requires-Dist: itsdangerous>=2.1
 Requires-Dist: email-validator>=2.0
+Requires-Dist: argon2-cffi>=23.1
+Requires-Dist: httpx>=0.27
 Requires-Dist: pytest>=8.0 ; extra == "dev"
 Requires-Dist: pytest-asyncio>=0.23 ; extra == "dev"
 Requires-Dist: ruff>=0.6 ; extra == "dev"
@@ -140,9 +141,12 @@ Optional for lockout support:
 The extension uses `SECURITY_*` keys for migration-friendly configuration.
 
 Core:
-- `SECURITY_PASSWORD_HASH` (default: `pbkdf2_sha512`)
+- `SECURITY_PASSWORD_HASH` (default: `argon2` / argon2id; set to `pbkdf2_sha512` to keep old behavior)
 - `SECURITY_PASSWORD_SALT` (recommended)
 - `SECURITY_PASSWORD_LENGTH_MIN` (default: `12`)
+- `SECURITY_PASSWORD_BREACH_CHECK` (default: `True`) - HIBP k-anonymity check on register/change
+- `SECURITY_PASSWORD_BREACH_COUNT_MIN` (default: `1`) - minimum breach count to reject
+- `SECURITY_ARGON2_MEMORY_COST` / `SECURITY_ARGON2_TIME_COST` / `SECURITY_ARGON2_PARALLELISM` - override argon2 params (production defaults: 19456/2/1)
 - `SECURITY_LOGIN_MAX_ATTEMPTS` (default: `5`)
 - `SECURITY_LOCKOUT_MINUTES` (default: `15`)
 - `SECURITY_REGISTERABLE`
@@ -150,6 +154,8 @@ Core:
 - `SECURITY_TRACKABLE`
 - `SECURITY_CSRF_PROTECT` (default: `True`)
 
+Existing pbkdf2_sha512 and bcrypt hashes continue to verify after the argon2 default change. They are transparently rehashed to argon2id on the user's next successful login.
+
 2FA:
 - `SECURITY_TWO_FACTOR`
 - `SECURITY_TOTP_ISSUER`

{quart_security-1.2.1 → quart_security-1.4.0}/README.md

@@ -113,9 +113,12 @@ Optional for lockout support:
 The extension uses `SECURITY_*` keys for migration-friendly configuration.
 
 Core:
-- `SECURITY_PASSWORD_HASH` (default: `pbkdf2_sha512`)
+- `SECURITY_PASSWORD_HASH` (default: `argon2` / argon2id; set to `pbkdf2_sha512` to keep old behavior)
 - `SECURITY_PASSWORD_SALT` (recommended)
 - `SECURITY_PASSWORD_LENGTH_MIN` (default: `12`)
+- `SECURITY_PASSWORD_BREACH_CHECK` (default: `True`) - HIBP k-anonymity check on register/change
+- `SECURITY_PASSWORD_BREACH_COUNT_MIN` (default: `1`) - minimum breach count to reject
+- `SECURITY_ARGON2_MEMORY_COST` / `SECURITY_ARGON2_TIME_COST` / `SECURITY_ARGON2_PARALLELISM` - override argon2 params (production defaults: 19456/2/1)
 - `SECURITY_LOGIN_MAX_ATTEMPTS` (default: `5`)
 - `SECURITY_LOCKOUT_MINUTES` (default: `15`)
 - `SECURITY_REGISTERABLE`
@@ -123,6 +126,8 @@ Core:
 - `SECURITY_TRACKABLE`
 - `SECURITY_CSRF_PROTECT` (default: `True`)
 
+Existing pbkdf2_sha512 and bcrypt hashes continue to verify after the argon2 default change. They are transparently rehashed to argon2id on the user's next successful login.
+
 2FA:
 - `SECURITY_TWO_FACTOR`
 - `SECURITY_TOTP_ISSUER`

{quart_security-1.2.1 → quart_security-1.4.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "flit_core.buildapi"
 
 [project]
 name = "quart-security"
-version = "1.2.1"
+version = "1.4.0"
 description = "Native async auth for Quart"
 readme = "README.md"
 requires-python = ">=3.11"
@@ -18,12 +18,13 @@ dependencies = [
   "libpass>=1.9",
   "pyotp>=2.9",
   "qrcode>=8.0",
-  "webauthn>=2.0",
+  "webauthn>=2.7",
   "wtforms>=3.1",
   "aiosmtplib>=3.0",
   "blinker>=1.7",
-  "itsdangerous>=2.1",
   "email-validator>=2.0",
+  "argon2-cffi>=23.1",
+  "httpx>=0.27",
 ]
 
 [project.optional-dependencies]
@@ -45,6 +46,7 @@ name = "quart_security"
 dev = [
   "pytest>=8.0",
   "pytest-asyncio>=0.23",
+  "respx>=0.23.1",
   "ruff>=0.6",
 ]
 

{quart_security-1.2.1 → quart_security-1.4.0}/quart_security/__init__.py

@@ -4,7 +4,12 @@ from .core import Security
 from .datastore import SQLAlchemyUserDatastore
 from .decorators import auth_required, roles_required
 from .models import RoleMixin, UserMixin
-from .password import hash_password, verify_password
+from .password import (
+    hash_password,
+    hash_password_async,
+    verify_password,
+    verify_password_async,
+)
 from .proxies import current_user
 from .signals import (
     password_changed,
@@ -23,7 +28,9 @@ __all__ = [
     "UserMixin",
     "RoleMixin",
     "hash_password",
+    "hash_password_async",
     "verify_password",
+    "verify_password_async",
     "current_user",
     "user_authenticated",
     "user_logged_out",

quart_security-1.4.0/quart_security/breach.py

@@ -0,0 +1,61 @@
+"""HIBP k-anonymity breach check (NIST 800-63B-4 SHALL)."""
+
+from __future__ import annotations
+
+import hashlib
+import logging
+
+import httpx
+
+logger = logging.getLogger(__name__)
+
+_HIBP_URL = "https://api.pwnedpasswords.com/range/{prefix}"
+_TIMEOUT = 3.0
+
+
+async def password_is_breached(password: str, *, count_min: int = 1) -> bool | None:
+    """Check whether *password* appears in the HIBP breach corpus.
+
+    Uses the k-anonymity range API: sends only the first 5 hex chars of the
+    SHA-1 digest. The full digest never leaves the process.
+
+    Returns:
+        True  - password appears >= count_min times.
+        False - password not found in response.
+        None  - network/HTTP error; caller should fail-open (allow the password).
+    """
+    sha1 = (
+        hashlib.sha1(password.encode("utf-8"), usedforsecurity=False)
+        .hexdigest()
+        .upper()
+    )
+    prefix, suffix = sha1[:5], sha1[5:]
+
+    try:
+        async with httpx.AsyncClient(timeout=_TIMEOUT) as client:
+            response = await client.get(
+                _HIBP_URL.format(prefix=prefix),
+                headers={"Add-Padding": "true"},
+            )
+            response.raise_for_status()
+    except Exception as exc:
+        logger.warning(
+            "HIBP breach check failed (%s: %s); failing open",
+            type(exc).__name__,
+            exc,
+        )
+        return None
+
+    for line in response.text.splitlines():
+        parts = line.split(":", 1)
+        if len(parts) != 2:
+            continue
+        candidate, raw_count = parts[0].strip(), parts[1].strip()
+        if candidate == suffix:
+            try:
+                count = int(raw_count)
+            except ValueError:
+                continue
+            return count >= count_min
+
+    return False

{quart_security-1.2.1 → quart_security-1.4.0}/quart_security/core.py

@@ -111,14 +111,15 @@ class Security:
     @staticmethod
     def _load_defaults(app):
         defaults = {
-            "SECURITY_PASSWORD_HASH": "pbkdf2_sha512",
+            "SECURITY_PASSWORD_HASH": "argon2",
+            "SECURITY_PASSWORD_BREACH_CHECK": True,
+            "SECURITY_PASSWORD_BREACH_COUNT_MIN": 1,
             "SECURITY_PASSWORD_LENGTH_MIN": 12,
             "SECURITY_REGISTERABLE": True,
             "SECURITY_CHANGEABLE": True,
             "SECURITY_TRACKABLE": True,
             "SECURITY_TWO_FACTOR": True,
             "SECURITY_WEBAUTHN": True,
-            "SECURITY_TWO_FACTOR_ENABLED_METHODS": ["authenticator"],
             "SECURITY_TOTP_ISSUER": "Quart",
             "SECURITY_MULTI_FACTOR_RECOVERY_CODES": True,
             "SECURITY_MULTI_FACTOR_RECOVERY_CODES_N": 3,
@@ -135,9 +136,7 @@ class Security:
             "SECURITY_POST_LOGIN_VIEW": "/",
             "SECURITY_POST_REGISTER_VIEW": "/login",
             "SECURITY_EMAIL_SENDER": "noreply@example.com",
-            "SECURITY_SEND_PASSWORD_CHANGE_EMAIL": False,
             "SECURITY_CSRF_PROTECT": True,
-            "SECURITY_API_ENABLED_METHODS": ["session"],
         }
 
         for key, value in defaults.items():
@@ -161,9 +160,13 @@ class Security:
         if not user_id:
             raise RuntimeError("User must have fs_uniquifier/get_id for session login")
 
+        # Regenerate session to prevent fixation: discard pre-login state,
+        # then write only the login keys into a clean session.
+        session.clear()
         session["_user_id"] = user_id
         session["_fresh"] = bool(fresh)
         session["_id"] = secrets.token_hex(16)
+        session.modified = True
         g._current_user = user
 
         if app.config.get("SECURITY_TRACKABLE", True):

quart_security-1.4.0/quart_security/password.py

@@ -0,0 +1,90 @@
+"""Password hashing and validation helpers."""
+
+import asyncio
+
+from passlib.context import CryptContext
+
+_pwd_context: CryptContext | None = None
+_password_salt: str | None = None
+
+# OWASP 2025 minimum argon2id parameters
+_ARGON2_MEMORY_COST = 19456  # KiB
+_ARGON2_TIME_COST = 2
+_ARGON2_PARALLELISM = 1
+
+
+def init_password_context(app):
+    """Initialize passlib context from app config.
+
+    Default scheme is argon2id (OWASP 2025). Existing pbkdf2_sha512 and bcrypt
+    hashes continue to verify and are transparently rehashed on next login when
+    password_needs_rehash() returns True.
+
+    Set SECURITY_PASSWORD_HASH to override the default scheme.
+    Set SECURITY_ARGON2_MEMORY_COST / _TIME_COST / _PARALLELISM to override
+    argon2 parameters (useful for test environments).
+    """
+    global _pwd_context, _password_salt
+
+    scheme = app.config.get("SECURITY_PASSWORD_HASH", "argon2")
+    _password_salt = app.config.get("SECURITY_PASSWORD_SALT")
+
+    memory_cost = app.config.get("SECURITY_ARGON2_MEMORY_COST", _ARGON2_MEMORY_COST)
+    time_cost = app.config.get("SECURITY_ARGON2_TIME_COST", _ARGON2_TIME_COST)
+    parallelism = app.config.get("SECURITY_ARGON2_PARALLELISM", _ARGON2_PARALLELISM)
+
+    # Build context: argon2 with OWASP params, legacy schemes deprecated.
+    # CryptContext handles per-scheme kwargs via <scheme>__<param> notation.
+    _pwd_context = CryptContext(
+        schemes=["argon2", "pbkdf2_sha512", "bcrypt"],
+        default=scheme,
+        deprecated="auto",
+        argon2__memory_cost=memory_cost,
+        argon2__time_cost=time_cost,
+        argon2__parallelism=parallelism,
+        argon2__type="id",
+    )
+
+
+def _ensure_context() -> CryptContext:
+    if _pwd_context is None:
+        raise RuntimeError("Password context is not initialized")
+    return _pwd_context
+
+
+def hash_password(password: str) -> str:
+    return _ensure_context().hash(password)
+
+
+def verify_password(password: str, password_hash: str) -> bool:
+    context = _ensure_context()
+    if context.verify(password, password_hash):
+        return True
+    # Optional fallback for deployments that previously mixed in app salt.
+    if _password_salt:
+        return context.verify(f"{password}{_password_salt}", password_hash)
+    return False
+
+
+def password_needs_rehash(password_hash: str) -> bool:
+    """Return True if the hash was made with a deprecated/weaker scheme.
+
+    Call this after a successful verify to decide whether to upgrade the
+    stored hash transparently on login.
+    """
+    return _ensure_context().needs_update(password_hash)
+
+
+async def hash_password_async(password: str) -> str:
+    return await asyncio.to_thread(hash_password, password)
+
+
+async def verify_password_async(password: str, password_hash: str) -> bool:
+    return await asyncio.to_thread(verify_password, password, password_hash)
+
+
+def validate_password(password: str, min_length: int = 12) -> list[str]:
+    errors: list[str] = []
+    if len(password) < min_length:
+        errors.append(f"Password must be at least {min_length} characters")
+    return errors

{quart_security-1.2.1 → quart_security-1.4.0}/quart_security/templates/security/login_user.html

@@ -8,4 +8,7 @@
   {{ render_input(login_user_form.password, 'password') }}
   <button type="submit">Sign in</button>
 </form>
+{% if security.webauthn and security.wan_allow_as_first_factor %}
+<p><a href="{{ url_for_security('wan_signin') }}">Sign in with passkey</a></p>
+{% endif %}
 <p><a href="{{ url_for_security('register') }}">Create account</a></p>

{quart_security-1.2.1 → quart_security-1.4.0}/quart_security/templates/security/wan_signin.html

@@ -4,13 +4,10 @@
 <h1>Sign In with Passkey</h1>
 
 {% if not credential_options %}
-<form method="post" action="{{ url_for_security('wan_signin') }}" id="wan-signin-form">
+<form method="post" action="{{ url_for_security('wan_signin') }}" id="wan-discoverable-form">
   {{ wan_signin_form.hidden_tag() }}
-  {{ render_input(wan_signin_form.identity) }}
-  <label style="display: block; margin-bottom: 0.75rem;">
-    {{ wan_signin_form.remember }} {{ wan_signin_form.remember.label.text }}
-  </label>
-  <button type="submit">Continue</button>
+  <input type="hidden" name="identity" value="">
+  <button type="submit">Sign in with passkey</button>
 </form>
 <p><a href="{{ url_for_security('login') }}">Back to password login</a></p>
 {% else %}

{quart_security-1.2.1 → quart_security-1.4.0}/quart_security/totp.py

@@ -54,8 +54,13 @@ def generate_recovery_codes(n: int = 3) -> list[str]:
 
 def verify_recovery_code(code: str, stored_codes: list[str]) -> tuple[bool, list[str]]:
     normalized = code.strip().lower().replace("-", "").replace(" ", "")
-    for stored in stored_codes:
-        if normalized == stored.replace("-", ""):
-            remaining = [item for item in stored_codes if item != stored]
-            return True, remaining
+    matched_index = -1
+    for i, stored in enumerate(stored_codes):
+        stored_normalized = stored.strip().lower().replace("-", "").replace(" ", "")
+        # compare_digest on every entry — no early exit
+        if secrets.compare_digest(normalized, stored_normalized):
+            matched_index = i
+    if matched_index >= 0:
+        remaining = [item for i, item in enumerate(stored_codes) if i != matched_index]
+        return True, remaining
     return False, stored_codes

{quart_security-1.2.1 → quart_security-1.4.0}/quart_security/views.py

@@ -20,6 +20,7 @@ from quart import (
 from werkzeug.routing import BuildError
 
 from . import webauthn as wan
+from .breach import password_is_breached
 from .decorators import auth_required
 from .forms import (
     QuartForm,
@@ -29,7 +30,12 @@ from .forms import (
     WebAuthnRegisterForm,
     WebAuthnVerifyForm,
 )
-from .password import hash_password, validate_password, verify_password
+from .password import (
+    hash_password_async,
+    password_needs_rehash,
+    validate_password,
+    verify_password_async,
+)
 from .proxies import _security, current_user
 from .signals import password_changed, tf_profile_changed, user_registered
 from .utils import maybe_await, naive_utcnow, url_for_security
@@ -96,6 +102,13 @@ def _ensure_csrf_token() -> str:
 def _safe_redirect_target(candidate: str | None, fallback: str = "/") -> str:
     if not candidate:
         return fallback
+    # Reject control characters (ASCII 0-31)
+    if any(ord(c) < 32 for c in candidate):
+        return fallback
+    # Reject backslash variants before any query string
+    path_part = candidate.split("?", 1)[0]
+    if "\\" in path_part:
+        return fallback
     parts = urlsplit(candidate)
     if parts.scheme or parts.netloc:
         return fallback
@@ -200,6 +213,21 @@ def _extract_webauthn_credential_id(credential_payload: dict | None) -> bytes |
         return None
 
 
+def _extract_webauthn_user_handle(credential_payload: dict | None) -> str | None:
+    if not isinstance(credential_payload, dict):
+        return None
+    response = credential_payload.get("response")
+    if not isinstance(response, dict):
+        return None
+    user_handle = response.get("userHandle")
+    if not isinstance(user_handle, str) or not user_handle:
+        return None
+    try:
+        return wan.base64url_to_bytes(user_handle).decode("utf-8")
+    except Exception:
+        return None
+
+
 async def _extract_webauthn_credential_payload():
     payload = await request.get_json(silent=True)
     if isinstance(payload, dict):
@@ -256,7 +284,7 @@ async def login():
 
         # Account lockout check
         if user and hasattr(user, "locked_until") and user.locked_until:
-            if datetime.datetime.now() < user.locked_until:
+            if naive_utcnow() < user.locked_until:
                 await flash("Account temporarily locked. Try again later.", "error")
                 return await render_template(
                     "security/login_user.html", login_user_form=form
@@ -269,8 +297,13 @@ async def login():
         if (
             user
             and getattr(user, "active", True)
-            and verify_password(form.password.data, user.password)
+            and await verify_password_async(form.password.data, user.password)
         ):
+            # Transparent rehash: upgrade weak/legacy hash on successful login
+            if password_needs_rehash(user.password):
+                user.password = await hash_password_async(form.password.data)
+                await _commit()
+
             # Reset failed attempts on success
             if (
                 hasattr(user, "failed_login_count")
@@ -295,7 +328,7 @@ async def login():
             max_attempts = current_app.config.get("SECURITY_LOGIN_MAX_ATTEMPTS", 5)
             lockout_minutes = current_app.config.get("SECURITY_LOCKOUT_MINUTES", 15)
             if user.failed_login_count >= max_attempts:
-                user.locked_until = datetime.datetime.now() + datetime.timedelta(
+                user.locked_until = naive_utcnow() + datetime.timedelta(
                     minutes=lockout_minutes
                 )
             await _commit()
@@ -332,9 +365,24 @@ async def register():
                 "security/register_user.html", register_user_form=form
             )
 
+        if current_app.config.get("SECURITY_PASSWORD_BREACH_CHECK", True):
+            count_min = current_app.config.get("SECURITY_PASSWORD_BREACH_COUNT_MIN", 1)
+            breached = await password_is_breached(
+                form.password.data, count_min=count_min
+            )
+            if breached:
+                await flash(
+                    "This password has appeared in a data breach."
+                    " Choose a different one.",
+                    "error",
+                )
+                return await render_template(
+                    "security/register_user.html", register_user_form=form
+                )
+
         user_kwargs = {
             "email": email,
-            "password": hash_password(form.password.data),
+            "password": await hash_password_async(form.password.data),
             "active": True,
         }
         if hasattr(form, "name") and form.name.data:
@@ -380,7 +428,7 @@ async def change_password():
                 return await render_template(
                     "security/change_password.html", change_password_form=form
                 )
-            if not verify_password(current_password, user.password):
+            if not await verify_password_async(current_password, user.password):
                 await flash("Invalid current password", "error")
                 return await render_template(
                     "security/change_password.html", change_password_form=form
@@ -402,7 +450,22 @@ async def change_password():
                 "security/change_password.html", change_password_form=form
             )
 
-        user.password = hash_password(form.new_password.data)
+        if current_app.config.get("SECURITY_PASSWORD_BREACH_CHECK", True):
+            count_min = current_app.config.get("SECURITY_PASSWORD_BREACH_COUNT_MIN", 1)
+            breached = await password_is_breached(
+                form.new_password.data, count_min=count_min
+            )
+            if breached:
+                await flash(
+                    "This password has appeared in a data breach."
+                    " Choose a different one.",
+                    "error",
+                )
+                return await render_template(
+                    "security/change_password.html", change_password_form=form
+                )
+
+        user.password = await hash_password_async(form.new_password.data)
         if hasattr(user, "password_set"):
             user.password_set = True
 
@@ -689,6 +752,7 @@ async def wan_register():
             rp_name=_webauthn_rp_name(),
             challenge=challenge,
             existing_credentials=registered_credentials,
+            discoverable=(requested_usage == "primary"),
         )
         credential_options = wan.options_to_json_dict(options)
 
@@ -737,7 +801,10 @@ async def wan_register_response():
                 "SECURITY_WAN_REQUIRE_USER_VERIFICATION", True
             ),
         )
-    except Exception:
+    except Exception as exc:
+        current_app.logger.warning(
+            "WebAuthn registration failed: %s: %s", type(exc).__name__, exc
+        )
         await flash("Passkey registration failed.", "error")
         return redirect(url_for_security("wan_register"))
 
@@ -776,46 +843,13 @@ async def wan_signin():
     response_form = await QuartForm.from_formdata()
 
     credential_options = None
+
     if _is_post():
         await _enforce_csrf(getattr(form, "_submitted_csrf", None))
-        identity = _normalize_email(form.identity.data)
-        if not identity:
-            await flash("Email is required.", "error")
-            return await render_template(
-                "security/wan_signin.html",
-                wan_signin_form=form,
-                wan_signin_response_form=response_form,
-                credential_options=None,
-            )
-
-        user = await _find_user(email=identity)
-        if user is None or not getattr(user, "active", True):
-            await flash("Unable to authenticate with passkey.", "error")
-            return await render_template(
-                "security/wan_signin.html",
-                wan_signin_form=form,
-                wan_signin_response_form=response_form,
-                credential_options=None,
-            )
-
-        credentials = await _list_webauthn_credentials(user)
-        credentials = [
-            credential
-            for credential in credentials
-            if getattr(credential, "usage", "secondary") in {"primary", "first"}
-        ]
-        if not credentials:
-            await flash("No passkey is configured for passwordless sign-in.", "error")
-            return await render_template(
-                "security/wan_signin.html",
-                wan_signin_form=form,
-                wan_signin_response_form=response_form,
-                credential_options=None,
-            )
 
         challenge = secrets.token_bytes(32)
         options = await wan.begin_authentication(
-            credentials,
+            [],
             rp_id=_webauthn_rp_id(),
             challenge=challenge,
         )
@@ -823,7 +857,6 @@ async def wan_signin():
         _set_wan_state(
             "wan_signin_state",
             challenge=wan.bytes_to_base64url(challenge),
-            user_id=user.get_id(),
             remember=bool(form.remember.data),
         )
 
@@ -848,18 +881,29 @@ async def wan_signin_response():
         await flash("Passkey sign-in expired. Please try again.", "error")
         return redirect(url_for_security("wan_signin"))
 
-    user = await _find_user(fs_uniquifier=state.get("user_id"))
-    if user is None:
-        await flash("Unable to find user for passkey sign-in.", "error")
-        return redirect(url_for_security("wan_signin"))
-
     credential_payload = await _extract_webauthn_credential_payload()
     credential_id = _extract_webauthn_credential_id(credential_payload)
     if not credential_payload or credential_id is None:
         await flash("Invalid passkey response payload.", "error")
         return redirect(url_for_security("wan_signin"))
 
-    stored_credential = await _find_webauthn_credential(credential_id, user=user)
+    stored_credential = await _find_webauthn_credential(credential_id, user=None)
+    if stored_credential is None:
+        await flash("Passkey not recognized.", "error")
+        return redirect(url_for_security("wan_signin"))
+
+    credential_user_id = getattr(stored_credential, "user_id", None)
+    user_handle = _extract_webauthn_user_handle(credential_payload)
+    lookup_handle = credential_user_id or user_handle
+    if not lookup_handle:
+        await flash("Unable to identify user from passkey.", "error")
+        return redirect(url_for_security("wan_signin"))
+
+    user = await _find_user(fs_webauthn_user_handle=lookup_handle)
+    if user is None or not getattr(user, "active", True):
+        await flash("Unable to find user for passkey sign-in.", "error")
+        return redirect(url_for_security("wan_signin"))
+
     if stored_credential is None:
         await flash("Passkey not recognized.", "error")
         return redirect(url_for_security("wan_signin"))
@@ -875,7 +919,10 @@ async def wan_signin_response():
                 "SECURITY_WAN_REQUIRE_USER_VERIFICATION", True
             ),
         )
-    except Exception:
+    except Exception as exc:
+        current_app.logger.warning(
+            "WebAuthn sign-in failed: %s: %s", type(exc).__name__, exc
+        )
         await flash("Passkey verification failed.", "error")
         return redirect(url_for_security("wan_signin"))
 
@@ -981,7 +1028,10 @@ async def wan_verify_response():
                 "SECURITY_WAN_REQUIRE_USER_VERIFICATION", True
             ),
         )
-    except Exception:
+    except Exception as exc:
+        current_app.logger.warning(
+            "WebAuthn verification failed: %s: %s", type(exc).__name__, exc
+        )
         await flash("Passkey verification failed.", "error")
         return redirect(url_for_security("wan_verify"))
 

{quart_security-1.2.1 → quart_security-1.4.0}/quart_security/webauthn.py

@@ -26,7 +26,12 @@ def _require_webauthn():
             verify_authentication_response,
             verify_registration_response,
         )
-        from webauthn.helpers.structs import PublicKeyCredentialDescriptor
+        from webauthn.helpers.structs import (
+            AuthenticatorSelectionCriteria,
+            PublicKeyCredentialDescriptor,
+            ResidentKeyRequirement,
+            UserVerificationRequirement,
+        )
     except ImportError as exc:
         raise RuntimeError("webauthn package is required for WebAuthn support") from exc
 
@@ -37,6 +42,9 @@ def _require_webauthn():
         "verify_authentication_response": verify_authentication_response,
         "verify_registration_response": verify_registration_response,
         "PublicKeyCredentialDescriptor": PublicKeyCredentialDescriptor,
+        "AuthenticatorSelectionCriteria": AuthenticatorSelectionCriteria,
+        "ResidentKeyRequirement": ResidentKeyRequirement,
+        "UserVerificationRequirement": UserVerificationRequirement,
     }
 
 
@@ -59,6 +67,7 @@ async def begin_registration(
     rp_name,
     challenge: bytes,
     existing_credentials=None,
+    discoverable: bool = False,
 ):
     api = _require_webauthn()
 
@@ -72,15 +81,23 @@ async def begin_registration(
             api["PublicKeyCredentialDescriptor"](id=cred.credential_id)
         )
 
-    return api["generate_registration_options"](
-        rp_id=rp_id,
-        rp_name=rp_name,
-        challenge=challenge,
-        user_id=user_id,
-        user_name=getattr(user, "email", ""),
-        user_display_name=getattr(user, "name", None) or getattr(user, "email", ""),
-        exclude_credentials=exclude_credentials,
-    )
+    kwargs = {
+        "rp_id": rp_id,
+        "rp_name": rp_name,
+        "challenge": challenge,
+        "user_id": user_id,
+        "user_name": getattr(user, "email", ""),
+        "user_display_name": getattr(user, "name", None) or getattr(user, "email", ""),
+        "exclude_credentials": exclude_credentials,
+    }
+
+    if discoverable:
+        kwargs["authenticator_selection"] = api["AuthenticatorSelectionCriteria"](
+            resident_key=api["ResidentKeyRequirement"].REQUIRED,
+            user_verification=api["UserVerificationRequirement"].REQUIRED,
+        )
+
+    return api["generate_registration_options"](**kwargs)
 
 
 async def complete_registration(

quart_security-1.2.1/quart_security/password.py

@@ -1,43 +0,0 @@
-"""Password hashing and validation helpers."""
-
-from passlib.context import CryptContext
-
-_pwd_context: CryptContext | None = None
-_password_salt: str | None = None
-
-
-def init_password_context(app):
-    """Initialize passlib context from app config."""
-    global _pwd_context, _password_salt
-
-    scheme = app.config.get("SECURITY_PASSWORD_HASH", "pbkdf2_sha512")
-    _password_salt = app.config.get("SECURITY_PASSWORD_SALT")
-    _pwd_context = CryptContext(schemes=[scheme], deprecated="auto")
-
-
-def _ensure_context() -> CryptContext:
-    if _pwd_context is None:
-        raise RuntimeError("Password context is not initialized")
-    return _pwd_context
-
-
-def hash_password(password: str) -> str:
-    # Keep default behavior compatible with existing Flask-Security hashes.
-    return _ensure_context().hash(password)
-
-
-def verify_password(password: str, password_hash: str) -> bool:
-    context = _ensure_context()
-    if context.verify(password, password_hash):
-        return True
-    # Optional fallback for deployments that previously mixed in app salt.
-    if _password_salt:
-        return context.verify(f"{password}{_password_salt}", password_hash)
-    return False
-
-
-def validate_password(password: str, min_length: int = 12) -> list[str]:
-    errors: list[str] = []
-    if len(password) < min_length:
-        errors.append(f"Password must be at least {min_length} characters")
-    return errors