quart-security 1.3.0__tar.gz → 1.4.0__tar.gz

{quart_security-1.3.0 → quart_security-1.4.0}/PKG-INFO

@@ -1,21 +1,23 @@
-Metadata-Version: 2.1
+Metadata-Version: 2.4
 Name: quart-security
-Version: 1.3.0
+Version: 1.4.0
 Summary: Native async auth for Quart
 Author: quart-security maintainers
 Requires-Python: >=3.11
 Description-Content-Type: text/markdown
+License-File: LICENSE
 Requires-Dist: quart>=0.20.0
 Requires-Dist: sqlalchemy>=2.0
 Requires-Dist: libpass>=1.9
 Requires-Dist: pyotp>=2.9
 Requires-Dist: qrcode>=8.0
-Requires-Dist: webauthn>=2.0
+Requires-Dist: webauthn>=2.7
 Requires-Dist: wtforms>=3.1
 Requires-Dist: aiosmtplib>=3.0
 Requires-Dist: blinker>=1.7
-Requires-Dist: itsdangerous>=2.1
 Requires-Dist: email-validator>=2.0
+Requires-Dist: argon2-cffi>=23.1
+Requires-Dist: httpx>=0.27
 Requires-Dist: pytest>=8.0 ; extra == "dev"
 Requires-Dist: pytest-asyncio>=0.23 ; extra == "dev"
 Requires-Dist: ruff>=0.6 ; extra == "dev"
@@ -139,9 +141,12 @@ Optional for lockout support:
 The extension uses `SECURITY_*` keys for migration-friendly configuration.
 
 Core:
-- `SECURITY_PASSWORD_HASH` (default: `pbkdf2_sha512`)
+- `SECURITY_PASSWORD_HASH` (default: `argon2` / argon2id; set to `pbkdf2_sha512` to keep old behavior)
 - `SECURITY_PASSWORD_SALT` (recommended)
 - `SECURITY_PASSWORD_LENGTH_MIN` (default: `12`)
+- `SECURITY_PASSWORD_BREACH_CHECK` (default: `True`) - HIBP k-anonymity check on register/change
+- `SECURITY_PASSWORD_BREACH_COUNT_MIN` (default: `1`) - minimum breach count to reject
+- `SECURITY_ARGON2_MEMORY_COST` / `SECURITY_ARGON2_TIME_COST` / `SECURITY_ARGON2_PARALLELISM` - override argon2 params (production defaults: 19456/2/1)
 - `SECURITY_LOGIN_MAX_ATTEMPTS` (default: `5`)
 - `SECURITY_LOCKOUT_MINUTES` (default: `15`)
 - `SECURITY_REGISTERABLE`
@@ -149,6 +154,8 @@ Core:
 - `SECURITY_TRACKABLE`
 - `SECURITY_CSRF_PROTECT` (default: `True`)
 
+Existing pbkdf2_sha512 and bcrypt hashes continue to verify after the argon2 default change. They are transparently rehashed to argon2id on the user's next successful login.
+
 2FA:
 - `SECURITY_TWO_FACTOR`
 - `SECURITY_TOTP_ISSUER`

{quart_security-1.3.0 → quart_security-1.4.0}/README.md

@@ -113,9 +113,12 @@ Optional for lockout support:
 The extension uses `SECURITY_*` keys for migration-friendly configuration.
 
 Core:
-- `SECURITY_PASSWORD_HASH` (default: `pbkdf2_sha512`)
+- `SECURITY_PASSWORD_HASH` (default: `argon2` / argon2id; set to `pbkdf2_sha512` to keep old behavior)
 - `SECURITY_PASSWORD_SALT` (recommended)
 - `SECURITY_PASSWORD_LENGTH_MIN` (default: `12`)
+- `SECURITY_PASSWORD_BREACH_CHECK` (default: `True`) - HIBP k-anonymity check on register/change
+- `SECURITY_PASSWORD_BREACH_COUNT_MIN` (default: `1`) - minimum breach count to reject
+- `SECURITY_ARGON2_MEMORY_COST` / `SECURITY_ARGON2_TIME_COST` / `SECURITY_ARGON2_PARALLELISM` - override argon2 params (production defaults: 19456/2/1)
 - `SECURITY_LOGIN_MAX_ATTEMPTS` (default: `5`)
 - `SECURITY_LOCKOUT_MINUTES` (default: `15`)
 - `SECURITY_REGISTERABLE`
@@ -123,6 +126,8 @@ Core:
 - `SECURITY_TRACKABLE`
 - `SECURITY_CSRF_PROTECT` (default: `True`)
 
+Existing pbkdf2_sha512 and bcrypt hashes continue to verify after the argon2 default change. They are transparently rehashed to argon2id on the user's next successful login.
+
 2FA:
 - `SECURITY_TWO_FACTOR`
 - `SECURITY_TOTP_ISSUER`

{quart_security-1.3.0 → quart_security-1.4.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "flit_core.buildapi"
 
 [project]
 name = "quart-security"
-version = "1.3.0"
+version = "1.4.0"
 description = "Native async auth for Quart"
 readme = "README.md"
 requires-python = ">=3.11"
@@ -18,12 +18,13 @@ dependencies = [
   "libpass>=1.9",
   "pyotp>=2.9",
   "qrcode>=8.0",
-  "webauthn>=2.0",
+  "webauthn>=2.7",
   "wtforms>=3.1",
   "aiosmtplib>=3.0",
   "blinker>=1.7",
-  "itsdangerous>=2.1",
   "email-validator>=2.0",
+  "argon2-cffi>=23.1",
+  "httpx>=0.27",
 ]
 
 [project.optional-dependencies]
@@ -45,6 +46,7 @@ name = "quart_security"
 dev = [
   "pytest>=8.0",
   "pytest-asyncio>=0.23",
+  "respx>=0.23.1",
   "ruff>=0.6",
 ]
 

{quart_security-1.3.0 → quart_security-1.4.0}/quart_security/__init__.py

@@ -4,7 +4,12 @@ from .core import Security
 from .datastore import SQLAlchemyUserDatastore
 from .decorators import auth_required, roles_required
 from .models import RoleMixin, UserMixin
-from .password import hash_password, verify_password
+from .password import (
+    hash_password,
+    hash_password_async,
+    verify_password,
+    verify_password_async,
+)
 from .proxies import current_user
 from .signals import (
     password_changed,
@@ -23,7 +28,9 @@ __all__ = [
     "UserMixin",
     "RoleMixin",
     "hash_password",
+    "hash_password_async",
     "verify_password",
+    "verify_password_async",
     "current_user",
     "user_authenticated",
     "user_logged_out",

quart_security-1.4.0/quart_security/breach.py

@@ -0,0 +1,61 @@
+"""HIBP k-anonymity breach check (NIST 800-63B-4 SHALL)."""
+
+from __future__ import annotations
+
+import hashlib
+import logging
+
+import httpx
+
+logger = logging.getLogger(__name__)
+
+_HIBP_URL = "https://api.pwnedpasswords.com/range/{prefix}"
+_TIMEOUT = 3.0
+
+
+async def password_is_breached(password: str, *, count_min: int = 1) -> bool | None:
+    """Check whether *password* appears in the HIBP breach corpus.
+
+    Uses the k-anonymity range API: sends only the first 5 hex chars of the
+    SHA-1 digest. The full digest never leaves the process.
+
+    Returns:
+        True  - password appears >= count_min times.
+        False - password not found in response.
+        None  - network/HTTP error; caller should fail-open (allow the password).
+    """
+    sha1 = (
+        hashlib.sha1(password.encode("utf-8"), usedforsecurity=False)
+        .hexdigest()
+        .upper()
+    )
+    prefix, suffix = sha1[:5], sha1[5:]
+
+    try:
+        async with httpx.AsyncClient(timeout=_TIMEOUT) as client:
+            response = await client.get(
+                _HIBP_URL.format(prefix=prefix),
+                headers={"Add-Padding": "true"},
+            )
+            response.raise_for_status()
+    except Exception as exc:
+        logger.warning(
+            "HIBP breach check failed (%s: %s); failing open",
+            type(exc).__name__,
+            exc,
+        )
+        return None
+
+    for line in response.text.splitlines():
+        parts = line.split(":", 1)
+        if len(parts) != 2:
+            continue
+        candidate, raw_count = parts[0].strip(), parts[1].strip()
+        if candidate == suffix:
+            try:
+                count = int(raw_count)
+            except ValueError:
+                continue
+            return count >= count_min
+
+    return False

{quart_security-1.3.0 → quart_security-1.4.0}/quart_security/core.py

@@ -111,14 +111,15 @@ class Security:
     @staticmethod
     def _load_defaults(app):
         defaults = {
-            "SECURITY_PASSWORD_HASH": "pbkdf2_sha512",
+            "SECURITY_PASSWORD_HASH": "argon2",
+            "SECURITY_PASSWORD_BREACH_CHECK": True,
+            "SECURITY_PASSWORD_BREACH_COUNT_MIN": 1,
             "SECURITY_PASSWORD_LENGTH_MIN": 12,
             "SECURITY_REGISTERABLE": True,
             "SECURITY_CHANGEABLE": True,
             "SECURITY_TRACKABLE": True,
             "SECURITY_TWO_FACTOR": True,
             "SECURITY_WEBAUTHN": True,
-            "SECURITY_TWO_FACTOR_ENABLED_METHODS": ["authenticator"],
             "SECURITY_TOTP_ISSUER": "Quart",
             "SECURITY_MULTI_FACTOR_RECOVERY_CODES": True,
             "SECURITY_MULTI_FACTOR_RECOVERY_CODES_N": 3,
@@ -135,9 +136,7 @@ class Security:
             "SECURITY_POST_LOGIN_VIEW": "/",
             "SECURITY_POST_REGISTER_VIEW": "/login",
             "SECURITY_EMAIL_SENDER": "noreply@example.com",
-            "SECURITY_SEND_PASSWORD_CHANGE_EMAIL": False,
             "SECURITY_CSRF_PROTECT": True,
-            "SECURITY_API_ENABLED_METHODS": ["session"],
         }
 
         for key, value in defaults.items():
@@ -161,9 +160,13 @@ class Security:
         if not user_id:
             raise RuntimeError("User must have fs_uniquifier/get_id for session login")
 
+        # Regenerate session to prevent fixation: discard pre-login state,
+        # then write only the login keys into a clean session.
+        session.clear()
         session["_user_id"] = user_id
         session["_fresh"] = bool(fresh)
         session["_id"] = secrets.token_hex(16)
+        session.modified = True
         g._current_user = user
 
         if app.config.get("SECURITY_TRACKABLE", True):

quart_security-1.4.0/quart_security/password.py

@@ -0,0 +1,90 @@
+"""Password hashing and validation helpers."""
+
+import asyncio
+
+from passlib.context import CryptContext
+
+_pwd_context: CryptContext | None = None
+_password_salt: str | None = None
+
+# OWASP 2025 minimum argon2id parameters
+_ARGON2_MEMORY_COST = 19456  # KiB
+_ARGON2_TIME_COST = 2
+_ARGON2_PARALLELISM = 1
+
+
+def init_password_context(app):
+    """Initialize passlib context from app config.
+
+    Default scheme is argon2id (OWASP 2025). Existing pbkdf2_sha512 and bcrypt
+    hashes continue to verify and are transparently rehashed on next login when
+    password_needs_rehash() returns True.
+
+    Set SECURITY_PASSWORD_HASH to override the default scheme.
+    Set SECURITY_ARGON2_MEMORY_COST / _TIME_COST / _PARALLELISM to override
+    argon2 parameters (useful for test environments).
+    """
+    global _pwd_context, _password_salt
+
+    scheme = app.config.get("SECURITY_PASSWORD_HASH", "argon2")
+    _password_salt = app.config.get("SECURITY_PASSWORD_SALT")
+
+    memory_cost = app.config.get("SECURITY_ARGON2_MEMORY_COST", _ARGON2_MEMORY_COST)
+    time_cost = app.config.get("SECURITY_ARGON2_TIME_COST", _ARGON2_TIME_COST)
+    parallelism = app.config.get("SECURITY_ARGON2_PARALLELISM", _ARGON2_PARALLELISM)
+
+    # Build context: argon2 with OWASP params, legacy schemes deprecated.
+    # CryptContext handles per-scheme kwargs via <scheme>__<param> notation.
+    _pwd_context = CryptContext(
+        schemes=["argon2", "pbkdf2_sha512", "bcrypt"],
+        default=scheme,
+        deprecated="auto",
+        argon2__memory_cost=memory_cost,
+        argon2__time_cost=time_cost,
+        argon2__parallelism=parallelism,
+        argon2__type="id",
+    )
+
+
+def _ensure_context() -> CryptContext:
+    if _pwd_context is None:
+        raise RuntimeError("Password context is not initialized")
+    return _pwd_context
+
+
+def hash_password(password: str) -> str:
+    return _ensure_context().hash(password)
+
+
+def verify_password(password: str, password_hash: str) -> bool:
+    context = _ensure_context()
+    if context.verify(password, password_hash):
+        return True
+    # Optional fallback for deployments that previously mixed in app salt.
+    if _password_salt:
+        return context.verify(f"{password}{_password_salt}", password_hash)
+    return False
+
+
+def password_needs_rehash(password_hash: str) -> bool:
+    """Return True if the hash was made with a deprecated/weaker scheme.
+
+    Call this after a successful verify to decide whether to upgrade the
+    stored hash transparently on login.
+    """
+    return _ensure_context().needs_update(password_hash)
+
+
+async def hash_password_async(password: str) -> str:
+    return await asyncio.to_thread(hash_password, password)
+
+
+async def verify_password_async(password: str, password_hash: str) -> bool:
+    return await asyncio.to_thread(verify_password, password, password_hash)
+
+
+def validate_password(password: str, min_length: int = 12) -> list[str]:
+    errors: list[str] = []
+    if len(password) < min_length:
+        errors.append(f"Password must be at least {min_length} characters")
+    return errors

{quart_security-1.3.0 → quart_security-1.4.0}/quart_security/totp.py

@@ -54,8 +54,13 @@ def generate_recovery_codes(n: int = 3) -> list[str]:
 
 def verify_recovery_code(code: str, stored_codes: list[str]) -> tuple[bool, list[str]]:
     normalized = code.strip().lower().replace("-", "").replace(" ", "")
-    for stored in stored_codes:
-        if normalized == stored.replace("-", ""):
-            remaining = [item for item in stored_codes if item != stored]
-            return True, remaining
+    matched_index = -1
+    for i, stored in enumerate(stored_codes):
+        stored_normalized = stored.strip().lower().replace("-", "").replace(" ", "")
+        # compare_digest on every entry — no early exit
+        if secrets.compare_digest(normalized, stored_normalized):
+            matched_index = i
+    if matched_index >= 0:
+        remaining = [item for i, item in enumerate(stored_codes) if i != matched_index]
+        return True, remaining
     return False, stored_codes

{quart_security-1.3.0 → quart_security-1.4.0}/quart_security/views.py

@@ -20,6 +20,7 @@ from quart import (
 from werkzeug.routing import BuildError
 
 from . import webauthn as wan
+from .breach import password_is_breached
 from .decorators import auth_required
 from .forms import (
     QuartForm,
@@ -29,7 +30,12 @@ from .forms import (
     WebAuthnRegisterForm,
     WebAuthnVerifyForm,
 )
-from .password import hash_password, validate_password, verify_password
+from .password import (
+    hash_password_async,
+    password_needs_rehash,
+    validate_password,
+    verify_password_async,
+)
 from .proxies import _security, current_user
 from .signals import password_changed, tf_profile_changed, user_registered
 from .utils import maybe_await, naive_utcnow, url_for_security
@@ -96,6 +102,13 @@ def _ensure_csrf_token() -> str:
 def _safe_redirect_target(candidate: str | None, fallback: str = "/") -> str:
     if not candidate:
         return fallback
+    # Reject control characters (ASCII 0-31)
+    if any(ord(c) < 32 for c in candidate):
+        return fallback
+    # Reject backslash variants before any query string
+    path_part = candidate.split("?", 1)[0]
+    if "\\" in path_part:
+        return fallback
     parts = urlsplit(candidate)
     if parts.scheme or parts.netloc:
         return fallback
@@ -271,7 +284,7 @@ async def login():
 
         # Account lockout check
         if user and hasattr(user, "locked_until") and user.locked_until:
-            if datetime.datetime.now() < user.locked_until:
+            if naive_utcnow() < user.locked_until:
                 await flash("Account temporarily locked. Try again later.", "error")
                 return await render_template(
                     "security/login_user.html", login_user_form=form
@@ -284,8 +297,13 @@ async def login():
         if (
             user
             and getattr(user, "active", True)
-            and verify_password(form.password.data, user.password)
+            and await verify_password_async(form.password.data, user.password)
         ):
+            # Transparent rehash: upgrade weak/legacy hash on successful login
+            if password_needs_rehash(user.password):
+                user.password = await hash_password_async(form.password.data)
+                await _commit()
+
             # Reset failed attempts on success
             if (
                 hasattr(user, "failed_login_count")
@@ -310,7 +328,7 @@ async def login():
             max_attempts = current_app.config.get("SECURITY_LOGIN_MAX_ATTEMPTS", 5)
             lockout_minutes = current_app.config.get("SECURITY_LOCKOUT_MINUTES", 15)
             if user.failed_login_count >= max_attempts:
-                user.locked_until = datetime.datetime.now() + datetime.timedelta(
+                user.locked_until = naive_utcnow() + datetime.timedelta(
                     minutes=lockout_minutes
                 )
             await _commit()
@@ -347,9 +365,24 @@ async def register():
                 "security/register_user.html", register_user_form=form
             )
 
+        if current_app.config.get("SECURITY_PASSWORD_BREACH_CHECK", True):
+            count_min = current_app.config.get("SECURITY_PASSWORD_BREACH_COUNT_MIN", 1)
+            breached = await password_is_breached(
+                form.password.data, count_min=count_min
+            )
+            if breached:
+                await flash(
+                    "This password has appeared in a data breach."
+                    " Choose a different one.",
+                    "error",
+                )
+                return await render_template(
+                    "security/register_user.html", register_user_form=form
+                )
+
         user_kwargs = {
             "email": email,
-            "password": hash_password(form.password.data),
+            "password": await hash_password_async(form.password.data),
             "active": True,
         }
         if hasattr(form, "name") and form.name.data:
@@ -395,7 +428,7 @@ async def change_password():
                 return await render_template(
                     "security/change_password.html", change_password_form=form
                 )
-            if not verify_password(current_password, user.password):
+            if not await verify_password_async(current_password, user.password):
                 await flash("Invalid current password", "error")
                 return await render_template(
                     "security/change_password.html", change_password_form=form
@@ -417,7 +450,22 @@ async def change_password():
                 "security/change_password.html", change_password_form=form
             )
 
-        user.password = hash_password(form.new_password.data)
+        if current_app.config.get("SECURITY_PASSWORD_BREACH_CHECK", True):
+            count_min = current_app.config.get("SECURITY_PASSWORD_BREACH_COUNT_MIN", 1)
+            breached = await password_is_breached(
+                form.new_password.data, count_min=count_min
+            )
+            if breached:
+                await flash(
+                    "This password has appeared in a data breach."
+                    " Choose a different one.",
+                    "error",
+                )
+                return await render_template(
+                    "security/change_password.html", change_password_form=form
+                )
+
+        user.password = await hash_password_async(form.new_password.data)
         if hasattr(user, "password_set"):
             user.password_set = True
 
@@ -753,7 +801,10 @@ async def wan_register_response():
                 "SECURITY_WAN_REQUIRE_USER_VERIFICATION", True
             ),
         )
-    except Exception:
+    except Exception as exc:
+        current_app.logger.warning(
+            "WebAuthn registration failed: %s: %s", type(exc).__name__, exc
+        )
         await flash("Passkey registration failed.", "error")
         return redirect(url_for_security("wan_register"))
 
@@ -868,7 +919,10 @@ async def wan_signin_response():
                 "SECURITY_WAN_REQUIRE_USER_VERIFICATION", True
             ),
         )
-    except Exception:
+    except Exception as exc:
+        current_app.logger.warning(
+            "WebAuthn sign-in failed: %s: %s", type(exc).__name__, exc
+        )
         await flash("Passkey verification failed.", "error")
         return redirect(url_for_security("wan_signin"))
 
@@ -974,7 +1028,10 @@ async def wan_verify_response():
                 "SECURITY_WAN_REQUIRE_USER_VERIFICATION", True
             ),
         )
-    except Exception:
+    except Exception as exc:
+        current_app.logger.warning(
+            "WebAuthn verification failed: %s: %s", type(exc).__name__, exc
+        )
         await flash("Passkey verification failed.", "error")
         return redirect(url_for_security("wan_verify"))
 

quart_security-1.3.0/.github/workflows/ci.yml

@@ -1,34 +0,0 @@
-name: CI
-
-on:
-  push:
-    branches:
-      - main
-  pull_request:
-
-jobs:
-  test:
-    runs-on: ubuntu-latest
-
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-
-      - name: Set up Python
-        uses: actions/setup-python@v5
-        with:
-          python-version: "3.11"
-
-      - name: Set up uv
-        uses: astral-sh/setup-uv@v6
-        with:
-          enable-cache: true
-
-      - name: Install dependencies
-        run: uv sync --group dev
-
-      - name: Run Ruff
-        run: uv run ruff check .
-
-      - name: Run tests
-        run: uv run pytest -q

quart_security-1.3.0/.github/workflows/publish.yml

@@ -1,37 +0,0 @@
-name: Publish
-
-on:
-  release:
-    types:
-      - published
-  workflow_dispatch:
-
-permissions:
-  contents: read
-  id-token: write
-
-jobs:
-  publish:
-    if: github.repository == 'level09/quart-security'
-    runs-on: ubuntu-latest
-    environment:
-      name: pypi
-      url: https://pypi.org/p/quart-security
-
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-
-      - name: Set up Python
-        uses: actions/setup-python@v5
-        with:
-          python-version: "3.12"
-
-      - name: Set up uv
-        uses: astral-sh/setup-uv@v6
-
-      - name: Build distributions
-        run: uv build
-
-      - name: Publish to PyPI
-        uses: pypa/gh-action-pypi-publish@release/v1

quart_security-1.3.0/.gitignore

@@ -1,8 +0,0 @@
-__pycache__/
-*.pyc
-.pytest_cache/
-.ruff_cache/
-.uv-cache/
-.venv/
-dist/
-uv.lock

quart_security-1.3.0/quart_security/password.py

@@ -1,43 +0,0 @@
-"""Password hashing and validation helpers."""
-
-from passlib.context import CryptContext
-
-_pwd_context: CryptContext | None = None
-_password_salt: str | None = None
-
-
-def init_password_context(app):
-    """Initialize passlib context from app config."""
-    global _pwd_context, _password_salt
-
-    scheme = app.config.get("SECURITY_PASSWORD_HASH", "pbkdf2_sha512")
-    _password_salt = app.config.get("SECURITY_PASSWORD_SALT")
-    _pwd_context = CryptContext(schemes=[scheme], deprecated="auto")
-
-
-def _ensure_context() -> CryptContext:
-    if _pwd_context is None:
-        raise RuntimeError("Password context is not initialized")
-    return _pwd_context
-
-
-def hash_password(password: str) -> str:
-    # Keep default behavior compatible with existing Flask-Security hashes.
-    return _ensure_context().hash(password)
-
-
-def verify_password(password: str, password_hash: str) -> bool:
-    context = _ensure_context()
-    if context.verify(password, password_hash):
-        return True
-    # Optional fallback for deployments that previously mixed in app salt.
-    if _password_salt:
-        return context.verify(f"{password}{_password_salt}", password_hash)
-    return False
-
-
-def validate_password(password: str, min_length: int = 12) -> list[str]:
-    errors: list[str] = []
-    if len(password) < min_length:
-        errors.append(f"Password must be at least {min_length} characters")
-    return errors