quart-security 1.4.0__tar.gz → 1.4.1__tar.gz

{quart_security-1.4.0 → quart_security-1.4.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: quart-security
-Version: 1.4.0
+Version: 1.4.1
 Summary: Native async auth for Quart
 Author: quart-security maintainers
 Requires-Python: >=3.11
@@ -136,6 +136,10 @@ Optional for lockout support:
 - `failed_login_count`
 - `locked_until`
 
+These fields are required when login or MFA lockout is enabled. The built-in
+counter limits account-level guesses. Deploy an application or edge rate limiter
+for source IP and distributed abuse controls.
+
 ## Key Configuration
 
 The extension uses `SECURITY_*` keys for migration-friendly configuration.
@@ -153,6 +157,7 @@ Core:
 - `SECURITY_CHANGEABLE`
 - `SECURITY_TRACKABLE`
 - `SECURITY_CSRF_PROTECT` (default: `True`)
+- `SECURITY_FRESHNESS` (default: `60` minutes)
 
 Existing pbkdf2_sha512 and bcrypt hashes continue to verify after the argon2 default change. They are transparently rehashed to argon2id on the user's next successful login.
 
@@ -162,6 +167,10 @@ Existing pbkdf2_sha512 and bcrypt hashes continue to verify after the argon2 def
 - `SECURITY_MULTI_FACTOR_RECOVERY_CODES`
 - `SECURITY_MULTI_FACTOR_RECOVERY_CODES_N`
 
+Recovery codes are displayed only when generated and are stored as keyed hashes.
+Existing plaintext codes remain valid until their next successful use, when the
+remaining codes are migrated.
+
 WebAuthn:
 - `SECURITY_WEBAUTHN`
 - `SECURITY_WAN_ALLOW_AS_FIRST_FACTOR`
@@ -180,7 +189,7 @@ Routing:
 Core:
 - `/login`
 - `/register`
-- `/logout`
+- `/logout` (POST only)
 - `/change`
 
 2FA:

{quart_security-1.4.0 → quart_security-1.4.1}/README.md

@@ -108,6 +108,10 @@ Optional for lockout support:
 - `failed_login_count`
 - `locked_until`
 
+These fields are required when login or MFA lockout is enabled. The built-in
+counter limits account-level guesses. Deploy an application or edge rate limiter
+for source IP and distributed abuse controls.
+
 ## Key Configuration
 
 The extension uses `SECURITY_*` keys for migration-friendly configuration.
@@ -125,6 +129,7 @@ Core:
 - `SECURITY_CHANGEABLE`
 - `SECURITY_TRACKABLE`
 - `SECURITY_CSRF_PROTECT` (default: `True`)
+- `SECURITY_FRESHNESS` (default: `60` minutes)
 
 Existing pbkdf2_sha512 and bcrypt hashes continue to verify after the argon2 default change. They are transparently rehashed to argon2id on the user's next successful login.
 
@@ -134,6 +139,10 @@ Existing pbkdf2_sha512 and bcrypt hashes continue to verify after the argon2 def
 - `SECURITY_MULTI_FACTOR_RECOVERY_CODES`
 - `SECURITY_MULTI_FACTOR_RECOVERY_CODES_N`
 
+Recovery codes are displayed only when generated and are stored as keyed hashes.
+Existing plaintext codes remain valid until their next successful use, when the
+remaining codes are migrated.
+
 WebAuthn:
 - `SECURITY_WEBAUTHN`
 - `SECURITY_WAN_ALLOW_AS_FIRST_FACTOR`
@@ -152,7 +161,7 @@ Routing:
 Core:
 - `/login`
 - `/register`
-- `/logout`
+- `/logout` (POST only)
 - `/change`
 
 2FA:

{quart_security-1.4.0 → quart_security-1.4.1}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "flit_core.buildapi"
 
 [project]
 name = "quart-security"
-version = "1.4.0"
+version = "1.4.1"
 description = "Native async auth for Quart"
 readme = "README.md"
 requires-python = ">=3.11"

{quart_security-1.4.0 → quart_security-1.4.1}/quart_security/core.py

@@ -3,6 +3,7 @@
 from __future__ import annotations
 
 import secrets
+import time
 from datetime import timedelta
 
 from quart import current_app, g, request, session
@@ -149,7 +150,11 @@ class Security:
             return
 
         user = await maybe_await(self.datastore.find_user(fs_uniquifier=user_id))
-        g._current_user = user or AnonymousUser()
+        if user is None or not getattr(user, "active", True):
+            session.clear()
+            g._current_user = AnonymousUser()
+            return
+        g._current_user = user
 
     async def login_user(self, user, fresh=True):
         app = current_app._get_current_object()
@@ -165,6 +170,7 @@ class Security:
         session.clear()
         session["_user_id"] = user_id
         session["_fresh"] = bool(fresh)
+        session["_auth_at"] = int(time.time())
         session["_id"] = secrets.token_hex(16)
         session.modified = True
         g._current_user = user

{quart_security-1.4.0 → quart_security-1.4.1}/quart_security/datastore.py

@@ -2,6 +2,7 @@
 
 from __future__ import annotations
 
+from contextvars import ContextVar
 from uuid import uuid4
 
 from sqlalchemy import select
@@ -15,10 +16,19 @@ class SQLAlchemyUserDatastore:
         self.user_model = user_model
         self.role_model = role_model
         self.webauthn_model = webauthn_model
+        self._active_session = ContextVar("quart_security_session", default=None)
 
     @property
     def session(self):
-        return self.session_factory()
+        source = self.session_factory
+        configured = getattr(source, "session", None)
+        if configured is not None:
+            return configured
+        active = self._active_session.get()
+        if active is None:
+            active = source() if callable(source) else source
+            self._active_session.set(active)
+        return active
 
     async def _first(self, model, **kwargs):
         stmt = select(model).filter_by(**kwargs)
@@ -130,6 +140,18 @@ class SQLAlchemyUserDatastore:
                 return credential
         return None
 
+    async def find_user_for_webauthn_credential(self, credential):
+        related_user = getattr(credential, "user", None)
+        if related_user is not None:
+            return related_user
+        owner_id = getattr(credential, "user_id", None)
+        if owner_id is None:
+            return None
+        user = await self.find_user(fs_webauthn_user_handle=owner_id)
+        if user is None and hasattr(self.user_model, "id"):
+            user = await self.find_user(id=owner_id)
+        return user
+
     async def create_webauthn_credential(self, user, **kwargs):
         if self.webauthn_model is None:
             raise RuntimeError("webauthn_model is required for WebAuthn credentials")
@@ -168,4 +190,8 @@ class SQLAlchemyUserDatastore:
         return True
 
     async def commit(self):
-        await self.session.commit()
+        active = self.session
+        try:
+            await active.commit()
+        finally:
+            self._active_session.set(None)

{quart_security-1.4.0 → quart_security-1.4.1}/quart_security/decorators.py

@@ -1,14 +1,16 @@
 """Authentication and authorization decorators."""
 
+import datetime
+import time
 from functools import wraps
 
-from quart import abort, current_app, redirect, request
+from quart import abort, current_app, redirect, request, session
 
 from .proxies import current_user
 from .utils import url_for_security
 
 
-def auth_required(*methods):
+def auth_required(*methods, fresh=False):
     """Require an authenticated user for a route."""
 
     allowed_methods = methods or ("session",)
@@ -22,6 +24,15 @@ def auth_required(*methods):
                 if request.is_json:
                     abort(401)
                 return redirect(url_for_security("login", next=request.url))
+            if fresh:
+                freshness = current_app.config.get(
+                    "SECURITY_FRESHNESS", datetime.timedelta(minutes=60)
+                )
+                max_age = freshness.total_seconds()
+                authenticated_at = session.get("_auth_at", 0)
+                is_stale = time.time() - authenticated_at > max_age
+                if not session.get("_fresh") or is_stale:
+                    abort(401)
             return await current_app.ensure_async(func)(*args, **kwargs)
 
         return wrapper

{quart_security-1.4.0 → quart_security-1.4.1}/quart_security/forms.py

@@ -109,5 +109,4 @@ class WebAuthnRegisterForm(QuartForm):
 
 class WebAuthnVerifyForm(QuartForm):
     identity = StringField("Email", validators=[Optional()])
-    remember = BooleanField("Remember me")
     credential = StringField("Credential", validators=[Optional()])

{quart_security-1.4.0 → quart_security-1.4.1}/quart_security/templates/security/mf_recovery_codes.html

@@ -8,6 +8,6 @@
   {% endfor %}
 </ul>
 <form method="post" action="{{ url_for_security('mf_recovery_codes') }}">
-  <input id="csrf_token" name="csrf_token" type="hidden" value="{{ csrf_token }}">
+  {{ mf_recovery_codes_form.hidden_tag() }}
   <button type="submit">Regenerate codes</button>
 </form>

{quart_security-1.4.0 → quart_security-1.4.1}/quart_security/totp.py

@@ -3,6 +3,8 @@
 from __future__ import annotations
 
 import base64
+import hashlib
+import hmac
 import io
 import secrets
 
@@ -52,13 +54,55 @@ def generate_recovery_codes(n: int = 3) -> list[str]:
     return codes
 
 
-def verify_recovery_code(code: str, stored_codes: list[str]) -> tuple[bool, list[str]]:
+_RECOVERY_HASH_PREFIX = "hmac-sha256$"
+
+
+def _normalize_recovery_code(code: str) -> str:
+    return code.strip().lower().replace("-", "").replace(" ", "")
+
+
+def _recovery_digest(code: str, secret_key: bytes | str) -> str:
+    if isinstance(secret_key, str):
+        secret_key = secret_key.encode()
+    digest = hmac.new(
+        secret_key, _normalize_recovery_code(code).encode(), hashlib.sha256
+    ).hexdigest()
+    return f"{_RECOVERY_HASH_PREFIX}{digest}"
+
+
+def hash_recovery_codes(codes: list[str], secret_key: bytes | str) -> list[str]:
+    return [_recovery_digest(code, secret_key) for code in codes]
+
+
+def ensure_hashed_recovery_codes(
+    codes: list[str], secret_key: bytes | str
+) -> list[str]:
+    return [
+        code if is_hashed_recovery_code(code) else _recovery_digest(code, secret_key)
+        for code in codes
+    ]
+
+
+def is_hashed_recovery_code(code: str) -> bool:
+    return code.startswith(_RECOVERY_HASH_PREFIX)
+
+
+def verify_recovery_code(
+    code: str, stored_codes: list[str], *, secret_key: bytes | str = b""
+) -> tuple[bool, list[str]]:
     normalized = code.strip().lower().replace("-", "").replace(" ", "")
+    submitted_hash = _recovery_digest(code, secret_key)
     matched_index = -1
     for i, stored in enumerate(stored_codes):
-        stored_normalized = stored.strip().lower().replace("-", "").replace(" ", "")
+        stored_normalized = _normalize_recovery_code(stored)
         # compare_digest on every entry — no early exit
-        if secrets.compare_digest(normalized, stored_normalized):
+        matches_plaintext = not is_hashed_recovery_code(
+            stored
+        ) and secrets.compare_digest(normalized, stored_normalized)
+        matches_hash = is_hashed_recovery_code(stored) and secrets.compare_digest(
+            submitted_hash, stored
+        )
+        if matches_plaintext or matches_hash:
             matched_index = i
     if matched_index >= 0:
         remaining = [item for i, item in enumerate(stored_codes) if i != matched_index]

{quart_security-1.4.0 → quart_security-1.4.1}/quart_security/views.py

@@ -75,6 +75,29 @@ async def _commit():
     await maybe_await(_security.datastore.commit())
 
 
+def _account_is_locked(user) -> bool:
+    locked_until = getattr(user, "locked_until", None)
+    return bool(locked_until and naive_utcnow() < locked_until)
+
+
+async def _record_auth_failure(user):
+    if not hasattr(user, "failed_login_count"):
+        return
+    user.failed_login_count = (user.failed_login_count or 0) + 1
+    max_attempts = current_app.config.get("SECURITY_LOGIN_MAX_ATTEMPTS", 5)
+    if user.failed_login_count >= max_attempts:
+        minutes = current_app.config.get("SECURITY_LOCKOUT_MINUTES", 15)
+        user.locked_until = naive_utcnow() + datetime.timedelta(minutes=minutes)
+    await _commit()
+
+
+async def _reset_auth_failures(user):
+    if hasattr(user, "failed_login_count"):
+        user.failed_login_count = 0
+        user.locked_until = None
+        await _commit()
+
+
 async def _enforce_csrf(submitted_token: str | None = None):
     if not _is_post():
         return
@@ -182,6 +205,19 @@ async def _find_webauthn_credential(credential_id: bytes, user=None):
     return None
 
 
+async def _find_webauthn_credential_owner(credential):
+    finder = getattr(_security.datastore, "find_user_for_webauthn_credential", None)
+    if finder:
+        return await maybe_await(finder(credential))
+    related_user = getattr(credential, "user", None)
+    if related_user is not None:
+        return related_user
+    owner_id = getattr(credential, "user_id", None)
+    if owner_id is None:
+        return None
+    return await _find_user(fs_webauthn_user_handle=owner_id)
+
+
 async def _create_webauthn_credential(user, **kwargs):
     creator = getattr(_security.datastore, "create_webauthn_credential", None)
     if creator:
@@ -304,34 +340,22 @@ async def login():
                 user.password = await hash_password_async(form.password.data)
                 await _commit()
 
-            # Reset failed attempts on success
-            if (
-                hasattr(user, "failed_login_count")
-                and (user.failed_login_count or 0) > 0
-            ):
-                user.failed_login_count = 0
-                user.locked_until = None
-                await _commit()
-
             if current_app.config.get("SECURITY_TWO_FACTOR") and getattr(
                 user, "tf_primary_method", None
             ):
-                session["tf_user_id"] = user.get_id()
+                session["tf_user_id"] = {
+                    "user_id": user.get_id(),
+                    "issued_at": int(naive_utcnow().timestamp()),
+                }
                 return redirect(url_for_security("two_factor_token_validation"))
 
+            await _reset_auth_failures(user)
             await _security.login_user(user)
             return redirect(_resolve_redirect("SECURITY_POST_LOGIN_VIEW", "login"))
 
         # Track failed login
-        if user and hasattr(user, "failed_login_count"):
-            user.failed_login_count = (user.failed_login_count or 0) + 1
-            max_attempts = current_app.config.get("SECURITY_LOGIN_MAX_ATTEMPTS", 5)
-            lockout_minutes = current_app.config.get("SECURITY_LOCKOUT_MINUTES", 15)
-            if user.failed_login_count >= max_attempts:
-                user.locked_until = naive_utcnow() + datetime.timedelta(
-                    minutes=lockout_minutes
-                )
-            await _commit()
+        if user:
+            await _record_auth_failure(user)
 
         await flash("Invalid email or password", "error")
 
@@ -401,15 +425,16 @@ async def register():
     return await render_template("security/register_user.html", register_user_form=form)
 
 
-@security_bp.route("/logout", methods=["GET", "POST"])
+@security_bp.route("/logout", methods=["POST"])
 async def logout():
+    await _enforce_csrf()
     await _security.logout_user()
     await flash("You have been logged out.", "info")
     return redirect(url_for_security("login"))
 
 
 @security_bp.route("/change", methods=["GET", "POST"])
-@auth_required("session")
+@auth_required("session", fresh=True)
 async def change_password():
     if not current_app.config.get("SECURITY_CHANGEABLE", False):
         abort(404)
@@ -486,7 +511,7 @@ async def change_password():
 
 
 @security_bp.route("/tf-setup", methods=["GET", "POST"])
-@auth_required("session")
+@auth_required("session", fresh=True)
 async def two_factor_setup():
     if not current_app.config.get("SECURITY_TWO_FACTOR", False):
         abort(404)
@@ -496,6 +521,7 @@ async def two_factor_setup():
         generate_recovery_codes,
         generate_totp_secret,
         get_totp_uri,
+        hash_recovery_codes,
         verify_totp,
     )
 
@@ -525,19 +551,29 @@ async def two_factor_setup():
                 current_user.tf_primary_method = "authenticator"
                 session.pop("tf_pending_secret", None)
 
+                raw_codes = []
                 if current_app.config.get("SECURITY_MULTI_FACTOR_RECOVERY_CODES", True):
                     if not getattr(current_user, "mf_recovery_codes", None):
                         count = current_app.config.get(
                             "SECURITY_MULTI_FACTOR_RECOVERY_CODES_N", 3
                         )
-                        current_user.mf_recovery_codes = generate_recovery_codes(count)
+                        raw_codes = generate_recovery_codes(count)
+                        current_user.mf_recovery_codes = hash_recovery_codes(
+                            raw_codes, current_app.secret_key
+                        )
 
                 await _commit()
                 await tf_profile_changed.send_async(
                     current_app._get_current_object(), user=current_user
                 )
                 await flash("Two-factor authentication enabled.", "success")
-                return redirect(url_for_security("mf_recovery_codes"))
+                recovery_form = await QuartForm.from_formdata()
+                return await render_template(
+                    "security/mf_recovery_codes.html",
+                    recovery_codes=raw_codes,
+                    has_codes=True,
+                    mf_recovery_codes_form=recovery_form,
+                )
 
             await flash("Invalid authentication code.", "error")
             return redirect(
@@ -576,11 +612,23 @@ async def two_factor_token_validation():
     if not current_app.config.get("SECURITY_TWO_FACTOR", False):
         abort(404)
 
-    from .totp import verify_recovery_code, verify_totp
+    from .totp import (
+        ensure_hashed_recovery_codes,
+        verify_recovery_code,
+        verify_totp,
+    )
 
     form = await TwoFactorVerifyForm.from_formdata()
     await _enforce_csrf(getattr(form, "_submitted_csrf", None))
-    user_id = session.get("tf_user_id")
+    tf_state = session.get("tf_user_id")
+    if isinstance(tf_state, dict):
+        if int(naive_utcnow().timestamp()) - tf_state.get("issued_at", 0) > 300:
+            session.pop("tf_user_id", None)
+            return redirect(url_for_security("login"))
+        user_id = tf_state.get("user_id")
+    else:
+        session.pop("tf_user_id", None)
+        return redirect(url_for_security("login"))
     if not user_id:
         return redirect(url_for_security("login"))
 
@@ -588,6 +636,9 @@ async def two_factor_token_validation():
     if user is None:
         session.pop("tf_user_id", None)
         return redirect(url_for_security("login"))
+    if _account_is_locked(user):
+        await flash("Account temporarily locked. Try again later.", "error")
+        return redirect(url_for_security("login"))
 
     if _is_post():
         form_data = await request.form
@@ -603,17 +654,23 @@ async def two_factor_token_validation():
             and current_app.config.get("SECURITY_MULTI_FACTOR_RECOVERY_CODES", True)
         ):
             codes = list(getattr(user, "mf_recovery_codes", None) or [])
-            ok, remaining = verify_recovery_code(token, codes)
+            ok, remaining = verify_recovery_code(
+                token, codes, secret_key=current_app.secret_key
+            )
             if ok:
-                user.mf_recovery_codes = remaining
+                user.mf_recovery_codes = ensure_hashed_recovery_codes(
+                    remaining, current_app.secret_key
+                )
                 await _commit()
                 valid = True
 
         if valid:
             session.pop("tf_user_id", None)
+            await _reset_auth_failures(user)
             await _security.login_user(user)
             return redirect(_resolve_redirect("SECURITY_POST_LOGIN_VIEW", "login"))
 
+        await _record_auth_failure(user)
         await flash("Invalid code", "error")
 
     return await render_template(
@@ -630,12 +687,12 @@ async def tf_select():
 
 
 @security_bp.route("/mf-recovery-codes", methods=["GET", "POST"])
-@auth_required("session")
+@auth_required("session", fresh=True)
 async def mf_recovery_codes():
     if not current_app.config.get("SECURITY_MULTI_FACTOR_RECOVERY_CODES", True):
         abort(404)
 
-    from .totp import generate_recovery_codes
+    from .totp import generate_recovery_codes, hash_recovery_codes
 
     # A dummy form just for hidden_tag() CSRF support
     form = await QuartForm.from_formdata()
@@ -645,14 +702,14 @@ async def mf_recovery_codes():
         await _enforce_csrf()
         count = current_app.config.get("SECURITY_MULTI_FACTOR_RECOVERY_CODES_N", 3)
         codes = generate_recovery_codes(count)
-        current_user.mf_recovery_codes = codes
+        current_user.mf_recovery_codes = hash_recovery_codes(
+            codes, current_app.secret_key
+        )
         await _commit()
         await tf_profile_changed.send_async(
             current_app._get_current_object(), user=current_user
         )
         await flash("Recovery codes regenerated.", "success")
-    elif request.args.get("show_codes"):
-        codes = list(getattr(current_user, "mf_recovery_codes", None) or [])
 
     has_codes = bool(getattr(current_user, "mf_recovery_codes", None))
 
@@ -670,33 +727,49 @@ async def mf_recovery():
     await _enforce_csrf(getattr(form, "_submitted_csrf", None))
 
     if _is_post() and form.validate():
-        user_id = session.get("tf_user_id")
+        tf_state = session.get("tf_user_id")
+        if not isinstance(tf_state, dict):
+            session.pop("tf_user_id", None)
+            return redirect(url_for_security("login"))
+        issued_at = tf_state.get("issued_at", 0)
+        if int(naive_utcnow().timestamp()) - issued_at > 300:
+            session.pop("tf_user_id", None)
+            return redirect(url_for_security("login"))
+        user_id = tf_state.get("user_id")
         if not user_id:
             return redirect(url_for_security("login"))
 
         user = await _find_user(fs_uniquifier=user_id)
         if user is None:
             return redirect(url_for_security("login"))
+        if _account_is_locked(user):
+            return redirect(url_for_security("login"))
 
-        from .totp import verify_recovery_code
+        from .totp import ensure_hashed_recovery_codes, verify_recovery_code
 
         ok, remaining = verify_recovery_code(
-            form.code.data.strip(), list(getattr(user, "mf_recovery_codes", None) or [])
+            form.code.data.strip(),
+            list(getattr(user, "mf_recovery_codes", None) or []),
+            secret_key=current_app.secret_key,
         )
         if ok:
-            user.mf_recovery_codes = remaining
+            user.mf_recovery_codes = ensure_hashed_recovery_codes(
+                remaining, current_app.secret_key
+            )
             await _commit()
             session.pop("tf_user_id", None)
+            await _reset_auth_failures(user)
             await _security.login_user(user)
             return redirect(_resolve_redirect("SECURITY_POST_LOGIN_VIEW", "login"))
 
+        await _record_auth_failure(user)
         await flash("Invalid recovery code", "error")
 
     return await render_template("security/mf_recovery.html", recovery_form=form)
 
 
 @security_bp.route("/wan-register", methods=["GET", "POST"])
-@auth_required("session")
+@auth_required("session", fresh=True)
 async def wan_register():
     if not current_app.config.get("SECURITY_WEBAUTHN", False):
         abort(404)
@@ -857,7 +930,6 @@ async def wan_signin():
         _set_wan_state(
             "wan_signin_state",
             challenge=wan.bytes_to_base64url(challenge),
-            remember=bool(form.remember.data),
         )
 
     return await render_template(
@@ -892,17 +964,18 @@ async def wan_signin_response():
         await flash("Passkey not recognized.", "error")
         return redirect(url_for_security("wan_signin"))
 
-    credential_user_id = getattr(stored_credential, "user_id", None)
     user_handle = _extract_webauthn_user_handle(credential_payload)
-    lookup_handle = credential_user_id or user_handle
-    if not lookup_handle:
+    user = await _find_webauthn_credential_owner(stored_credential)
+    if user is None:
         await flash("Unable to identify user from passkey.", "error")
         return redirect(url_for_security("wan_signin"))
 
-    user = await _find_user(fs_webauthn_user_handle=lookup_handle)
-    if user is None or not getattr(user, "active", True):
+    if not getattr(user, "active", True):
         await flash("Unable to find user for passkey sign-in.", "error")
         return redirect(url_for_security("wan_signin"))
+    if user_handle and user_handle != user.fs_webauthn_user_handle:
+        await flash("Passkey user handle mismatch.", "error")
+        return redirect(url_for_security("wan_signin"))
 
     if stored_credential is None:
         await flash("Passkey not recognized.", "error")
@@ -930,7 +1003,6 @@ async def wan_signin_response():
     if hasattr(stored_credential, "lastuse_datetime"):
         stored_credential.lastuse_datetime = naive_utcnow()
 
-    session.permanent = bool(state.get("remember"))
     await _security.login_user(user)
     return redirect(_resolve_redirect("SECURITY_POST_LOGIN_VIEW", "login"))
 
@@ -1047,7 +1119,7 @@ async def wan_verify_response():
 
 
 @security_bp.route("/wan-delete", methods=["POST"])
-@auth_required("session")
+@auth_required("session", fresh=True)
 async def wan_delete():
     if not current_app.config.get("SECURITY_WEBAUTHN", False):
         abort(404)